CVE-2018-8243

Vulnerability

A remote code execution vulnerability exists in the way the ChakraCore scripting engine handles objects in memory, specifically a memory corruption condition. This affects ChakraCore versions prior to 1.11.24 as per the release notes [1]. The vulnerability allows an attacker to corrupt memory in a way that can lead to code execution [2].

Exploitation

An attacker can exploit the vulnerability by hosting a specially crafted website or by embedding malicious content in an email or other vector that triggers ChakraCore to process the content. The user must visit the malicious site or open the crafted content using a browser or application that relies on ChakraCore. No authentication is required, and the attack can be executed remotely [2].

Impact

Successful exploitation allows the attacker to execute arbitrary code in the context of the current user. If the user has administrative rights, the attacker could take complete control of the affected system, including installing programs, viewing, changing, or deleting data, or creating new accounts with full user rights [2].

Mitigation

The vulnerability is fixed in ChakraCore 1.11.24, released as a patch update [1]. Users should update ChakraCore to version 1.11.24 or later. No workarounds are mentioned in the available references.