Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-nz4e-t72k-kbfz
Vulnerability ID VCID-nz4e-t72k-kbfz
Aliases CVE-2018-8298
GHSA-wgw2-wwq8-c7wf
Summary ChakraCore RCE Vulnerability A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.8937 https://api.first.org/data/v1/epss?cve=CVE-2018-8298
epss 0.8937 https://api.first.org/data/v1/epss?cve=CVE-2018-8298
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-wgw2-wwq8-c7wf
cvssv3.1 7.5 https://github.com/chakra-core/ChakraCore
generic_textual HIGH https://github.com/chakra-core/ChakraCore
cvssv3.1 7.5 https://github.com/chakra-core/ChakraCore/commit/cb9957e2763c36dbd12afa5c9261465159e16c86
generic_textual HIGH https://github.com/chakra-core/ChakraCore/commit/cb9957e2763c36dbd12afa5c9261465159e16c86
cvssv3.1 7.5 https://github.com/chakra-core/ChakraCore/pull/5444
generic_textual HIGH https://github.com/chakra-core/ChakraCore/pull/5444
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2018-8298
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2018-8298
cvssv3.1 7.5 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298
cvssv3.1 7.5 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298
generic_textual HIGH https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298
ssvc Attend https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298
cvssv3.1 7.5 https://web.archive.org/web/20210124183835/http://www.securityfocus.com/bid/104639
generic_textual HIGH https://web.archive.org/web/20210124183835/http://www.securityfocus.com/bid/104639
cvssv3.1 7.5 https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298
generic_textual HIGH https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298
cvssv3.1 7.5 https://www.exploit-db.com/exploits/45217
generic_textual HIGH https://www.exploit-db.com/exploits/45217
cvssv3.1 7.5 https://www.exploit-db.com/exploits/45217/
ssvc Attend https://www.exploit-db.com/exploits/45217/
cvssv3.1 7.5 http://www.securityfocus.com/bid/104639
ssvc Attend http://www.securityfocus.com/bid/104639
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2018-8298
https://github.com/chakra-core/ChakraCore
https://github.com/chakra-core/ChakraCore/commit/cb9957e2763c36dbd12afa5c9261465159e16c86
https://github.com/chakra-core/ChakraCore/pull/5444
https://web.archive.org/web/20210124183835/http://www.securityfocus.com/bid/104639
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298
https://www.exploit-db.com/exploits/45217
104639 http://www.securityfocus.com/bid/104639
45217 https://www.exploit-db.com/exploits/45217/
CVE-2018-8298 Exploit https://bugs.chromium.org/p/project-zero/issues/detail?id=1582
CVE-2018-8298 Exploit https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/windows/dos/45217.js
CVE-2018-8298 https://nvd.nist.gov/vuln/detail/CVE-2018-8298
CVE-2018-8298 https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298
GHSA-wgw2-wwq8-c7wf https://github.com/advisories/GHSA-wgw2-wwq8-c7wf
Data source Exploit-DB
Date added Aug. 17, 2018
Description Microsoft Edge Chakra JIT - InitializeNumberFormat and InitializeDateTimeFormat Type Confusion
Ransomware campaign use Known
Source publication date Aug. 17, 2018
Exploit type dos
Platform windows
Source update date Aug. 17, 2018
Source URL https://bugs.chromium.org/p/project-zero/issues/detail?id=1582
Data source KEV
Date added March 3, 2022
Description The ChakraCore scripting engine contains a type confusion vulnerability which can allow for remote code execution.
Required action Apply updates per vendor instructions.
Due date March 17, 2022
Note 
https://nvd.nist.gov/vuln/detail/CVE-2018-8298
Ransomware campaign use Unknown
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H Found at https://github.com/chakra-core/ChakraCore
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H Found at https://github.com/chakra-core/ChakraCore/commit/cb9957e2763c36dbd12afa5c9261465159e16c86
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H Found at https://github.com/chakra-core/ChakraCore/pull/5444
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H Found at https://nvd.nist.gov/vuln/detail/CVE-2018-8298
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H Found at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T16:26:02Z/ Found at https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H Found at https://web.archive.org/web/20210124183835/http://www.securityfocus.com/bid/104639
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H Found at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:H Found at https://www.exploit-db.com/exploits/45217
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at https://www.exploit-db.com/exploits/45217/
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T16:26:02Z/ Found at https://www.exploit-db.com/exploits/45217/
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H Found at http://www.securityfocus.com/bid/104639
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:A/A:N/T:T/P:M/B:A/M:M/D:A/2025-02-07T16:26:02Z/ Found at http://www.securityfocus.com/bid/104639
Exploit Prediction Scoring System (EPSS)
Percentile 0.9956
EPSS Score 0.8937
Published At June 4, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-02T04:42:55.241884+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/nuget/Microsoft.ChakraCore/CVE-2018-8298.yml 38.6.0