Main Vulnerability Database Vulnerabilities #VU16837

Memory corruption in Microsoft Edge - CVE-2019-0539

Published: January 8, 2019 / Updated: June 17, 2021

Vulnerability identifier: #VU16837

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2019-0539

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when the Chakra scripting engine handles objects in memory in Microsoft Edge. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Affected software

Microsoft Edge
ChakraCore

How to mitigate CVE-2019-0539

Install updates from vendor's website.

Links to Public Exploits and PoC-codes

Exploit #6150 - Microsoft Edge Chakra 1.11.4 - Read Permission via Type Confusion (June 17, 2021)

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0539