VYPR
← All advisories
High severityNVD Advisory· Published Nov 14, 2018· Updated Aug 5, 2024

CVE-2018-8556

CVE-2018-8556

Description

A memory corruption vulnerability in Chakra scripting engine allows remote code execution via crafted web content in Microsoft Edge.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A memory corruption vulnerability in Chakra scripting engine allows remote code execution via crafted web content in Microsoft Edge.

Vulnerability

A remote code execution vulnerability exists in the Chakra scripting engine's handling of objects in memory, leading to memory corruption. This affects Microsoft Edge on all supported Windows 10 builds and ChakraCore before the fix. The vulnerability is classified as a failure to handle exceptional conditions [1][2].

Exploitation

An attacker can host a specially crafted website or inject malicious content into a site. The target user must visit the site using Microsoft Edge. No authentication is required. The crafted content triggers a memory corruption error in the Chakra engine, allowing the attacker to execute arbitrary code in the context of the current user [2][4].

Impact

Successful exploitation grants the attacker the same user rights as the current user. The attacker can then install programs, view, change, or delete data, or create new accounts with full user rights. This can lead to complete compromise of the affected system [1][4].

Mitigation

Microsoft released a security update on November 13, 2018, as part of its monthly Patch Tuesday. Users should apply the update immediately. For ChakraCore, the fix is included in the November 2018 release; Microsoft continued to provide security updates for ChakraCore 1.11 until March 9, 2021. No workaround is available other than applying the patch [2][4].

References
  1. NVD - CVE-2018-8556
  2. Microsoft ChakraCore Scripting Engine CVE-2018-8556 Remote Memory Corruption Vulnerability
  3. Microsoft Edge Multiple Bugs Let Remote Users Execute Arbitrary Code and Obtain Conduct Cross-Site Scripting Attacks on the Target System

AI Insight generated on May 22, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
Microsoft.ChakraCoreNuGet
< 1.11.31.11.3

Affected products

3

Patches

1
2781608a34ea

CVE-2018-8556

https://github.com/chakra-core/ChakraCorePaul LeathersOct 9, 2018via ghsa
commit
1 file changed · +1 −1
  • lib/Backend/GlobOptBailOut.cpp+1 −1 modified
    @@ -1306,7 +1306,7 @@ GlobOpt::MayNeedBailOnImplicitCall(IR::Instr const * instr, Value const * src1Va
         return
             !(
                 baseValueType.IsString() ||
-                (baseValueType.IsAnyArray() && baseValueType.GetObjectType() != ObjectType::ObjectWithArray) ||
+                baseValueType.IsArray() ||
                 (instr->HasBailOutInfo() && instr->GetBailOutKindNoBits() == IR::BailOutOnIrregularLength) // guarantees no implicit calls
             );
     }

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

9

News mentions

0

No linked articles in our index yet.