# CVE-2018-8298

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore. This CVE ID is unique from CVE-2018-8242, CVE-2018-8283, CVE-2018-8287, CVE-2018-8288, CVE-2018-8291, CVE-2018-8296.

- Page: https://www.vulneraibility.com/cve/CVE-2018-8298
- CVSS: 7.5
- Known exploited: yes, in CISA KEV since 2022-03-03; CISA due date 2022-03-17
- EPSS: 74.69% (percentile 99.5)
- Public exploit code: 1 on Exploit-DB (first 2018-08-17)
- CISA SSVC: exploitation active, automatable no, technical impact total (assessed 2025-02-07)
- Weakness: CWE-843
- Published: 2018-07-11

## Affected versions

- Microsoft ChakraCore: affected ChakraCore

A version outside these ranges is not a statement that it is unaffected.

## References

- [other] https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8298
- [other] http://www.securityfocus.com/bid/104639
- [exploit] https://www.exploit-db.com/exploits/45217/
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8298

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.