VYPR
Get started
← All advisories
High severity7.5NVD Advisory· Published Dec 12, 2017· Updated May 13, 2026

CVE-2017-11914

CVE-2017-11914

Description

ChakraCore and Microsoft Edge in Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016 allows an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11886, CVE-2017-11889, CVE-2017-11890, CVE-2017-11893, CVE-2017-11894, CVE-2017-11895, CVE-2017-11901, CVE-2017-11903, CVE-2017-11905, CVE-2017-11905, CVE-2017-11907, CVE-2017-11908, CVE-2017-11909, CVE-2017-11910, CVE-2017-11911, CVE-2017-11912, CVE-2017-11913, CVE-2017-11916, CVE-2017-11918, and CVE-2017-11930.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.ChakraCoreNuGet
< 1.7.51.7.5

Affected products

3
  • Microsoft Corporation/ChakraCore, Microsoft Edgev5
    Range: Windows 10 1511, 1607, 1703, 1709, and Windows Server 2016.
  • Microsoft/Edge
    cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*
  • Microsoft/Chakracore
    cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:*
    Range: <1.7.5

Patches

1
b48808827939

[CVE-2017-11914] JavascriptGeneratorFunction::GetPropertyBuiltIns exposes scriptFunction - Google, Inc.

https://github.com/chakra-core/ChakraCoreAneesh DivakarakurupDec 1, 2017via ghsa
commit
1 file changed · +1 −1
  • lib/Runtime/Library/JavascriptGeneratorFunction.cpp+1 −1 modified
    @@ -307,7 +307,7 @@ namespace Js
             // to get the length from our private ScriptFunction instead of ourself.
             int len = 0;
             Var varLength;
-            if (scriptFunction->GetProperty(scriptFunction, PropertyIds::length, &varLength, NULL, requestContext))
+            if (scriptFunction->GetProperty(this, PropertyIds::length, &varLength, NULL, requestContext))
             {
                 len = JavascriptConversion::ToInt32(varLength, requestContext);
             }

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

11

News mentions

0

No linked articles in our index yet.