Memory corruption in Microsoft Edge - CVE-2017-11767

Vulnerability identifier: #VU8490

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2017-11767

CWE-ID: CWE-119

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The weakness exists due to object memory handling error in the Chakra scripting engine. A remote attacker can trick the victim into loading a specially crafted content, trigger memory corruption and execute arbitrary code with system privileges.

Successful exploitation of the vulnerability may result in system compromise.

Microsoft Edge
ChakraCore

Install update from vendor's website.

• http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11767

• Remote code execution in Microsoft Edge
• Multiple vulnerabilities in Microsoft ChakraCore