Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-heb9-gz3z-5bf1
Vulnerability ID VCID-heb9-gz3z-5bf1
Aliases CVE-2019-0648
GHSA-wwfw-m54g-gv72
Summary ChakraCore information disclosure vulnerability An information disclosure vulnerability exists when Chakra improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user's computer or data.To exploit the vulnerability, an attacker must know the memory address of where the object was created. The update addresses the vulnerability by changing the way certain functions handle objects in memory, aka Scripting Engine Information Disclosure Vulnerability. This CVE ID is unique from CVE-2019-0658.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (2)
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.14171 https://api.first.org/data/v1/epss?cve=CVE-2019-0648
epss 0.14171 https://api.first.org/data/v1/epss?cve=CVE-2019-0648
epss 0.14171 https://api.first.org/data/v1/epss?cve=CVE-2019-0648
epss 0.14171 https://api.first.org/data/v1/epss?cve=CVE-2019-0648
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-wwfw-m54g-gv72
cvssv3.1 4.3 https://github.com/chakra-core/ChakraCore
generic_textual MODERATE https://github.com/chakra-core/ChakraCore
cvssv3.1 4.3 https://github.com/chakra-core/ChakraCore/commit/1a7790f873b1a73d1cfec9548eb08a3b9fd798f3
generic_textual MODERATE https://github.com/chakra-core/ChakraCore/commit/1a7790f873b1a73d1cfec9548eb08a3b9fd798f3
cvssv3.1 4.3 https://github.com/chakra-core/ChakraCore/pull/5936
generic_textual MODERATE https://github.com/chakra-core/ChakraCore/pull/5936
cvssv3.1 4.3 https://nvd.nist.gov/vuln/detail/CVE-2019-0648
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2019-0648
cvssv3.1 4.3 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0648
generic_textual MODERATE https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0648
cvssv3.1 4.3 https://web.archive.org/web/20210729110650/http://www.securityfocus.com/bid/106885
generic_textual MODERATE https://web.archive.org/web/20210729110650/http://www.securityfocus.com/bid/106885
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2019-0648
https://github.com/chakra-core/ChakraCore
https://github.com/chakra-core/ChakraCore/commit/1a7790f873b1a73d1cfec9548eb08a3b9fd798f3
https://github.com/chakra-core/ChakraCore/pull/5936
https://github.com/chakra-core/ChakraCore/pull/5936/commits/1a7790f873b1a73d1cfec9548eb08a3b9fd798f3
https://web.archive.org/web/20210729110650/http://www.securityfocus.com/bid/106885
CVE-2019-0648 https://nvd.nist.gov/vuln/detail/CVE-2019-0648
CVE-2019-0648 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0648
GHSA-wwfw-m54g-gv72 https://github.com/advisories/GHSA-wwfw-m54g-gv72
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Found at https://github.com/chakra-core/ChakraCore
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Found at https://github.com/chakra-core/ChakraCore/commit/1a7790f873b1a73d1cfec9548eb08a3b9fd798f3
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Found at https://github.com/chakra-core/ChakraCore/pull/5936
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2019-0648
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Found at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0648
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N Found at https://web.archive.org/web/20210729110650/http://www.securityfocus.com/bid/106885
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.94503
EPSS Score 0.14171
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:42:30.033757+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/nuget/Microsoft.ChakraCore/CVE-2019-0648.yml 38.6.0