Main Vulnerability Database Vulnerabilities #VU14364

Memory corruption in Microsoft Edge - CVE-2018-8372

Published: August 14, 2018 / Updated: June 17, 2021

Vulnerability identifier: #VU14364

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-8372

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to boundary error when the scripting engine handles objects in memory in Microsoft browsers. A remote unauthenticated attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code with elevated privileges.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

Microsoft Edge
Microsoft Internet Explorer
ChakraCore

How to mitigate CVE-2018-8372

Install updates from vendor's website.

Links to Public Exploits and PoC-codes

Exploit #6147 - Microsoft Edge Chakra - OP_Memset Type Confusion (June 17, 2021)

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8372