CVE-2018-8298
High 7.5 Exploited in the wild (KEV)
Confirmed active exploitation — CISA KEV catalog
- Name
- ChakraCore Scripting Engine Type Confusion Vulnerability
- Added to catalog
- Remediation due date (US federal)
- Required action
- Apply updates per vendor instructions.
Description
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.
Metrics
- CVSS 3.1
-
7.5 (HIGH)
Score source: NVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H - EPSS — exploit probability
- 75% (percentile: 100) as of 1 November 2026
- CWE
- CWE-843
Affected products
microsoft: chakracore
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298 PatchVendor Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298 PatchVendor Advisory
- https://www.exploit-db.com/exploits/45217/ ExploitThird Party AdvisoryVDB Entry
- https://www.exploit-db.com/exploits/45217/ ExploitThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/104639 Broken LinkThird Party AdvisoryVDB Entry
- http://www.securityfocus.com/bid/104639 Broken LinkThird Party AdvisoryVDB Entry
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018… US Government Resource