CVE-2018-8298

State: Published
Severity: 7.5 High
Published: Jul 11, 2018
Updated: Oct 21, 2025
Reserved: Mar 14, 2018

Description

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H	CISA-ADP

Weaknesses

CWE-843 Access of Resource Using Incompatible Type ('Type Confusion')

Affected Products

Product	Versions
ChakraCoreMicrosoft	ChakraCoreAffected

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298
104639vdb-entry
45217exploit
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298government-resource

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.