Live › vulnerability › CVE-2018-8298
Go to dashboardType confusion/memory corruption in the ChakraCore JavaScript engine (Intl InitializeNumberFormat/InitializeDateTimeFormat bugs) gives remote code execution as the current user when the engine runs attacker-controlled script. Fixed in the July 2018 security update (ChakraCore 1.10.1). In CISA KEV. ChakraCore is no longer maintained by Microsoft, so embedders must be on 1.10.1 or later.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply updates per vendor instructions.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| ChakraCore ChakraCore scripting engine | vendor | – | – |
| ChakraCore | vendor | < 1.10.1 | 1.10.1 |
| Microsoft.ChakraCore | nuget | < 1.10.1 | 1.10.1 |
1.10.1), or the ChakraCore.dll/libChakraCore file version or embedded build1.10.1 is vulnerable1.10.1 or later (prefer the last 1.11.x, 1.11.24)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.
This page as .md · .json · in your agent: get_signal("CVE-2018-8298")
CISA KEV catalog, Creative Commons 0 · EPSS scores by FIRST, used with attribution · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.