A remote code execution vulnerability exists in the way affected Microsoft scripting engine render when handling objects in memory in Micro…

Published 9 y ago 2017-07-14 · modified 4 mo ago 2026-06-17 · JSON

CVSS

8.1

v3.0 · NVD

CISA KEV

not known exploited

EPSS

10.8%

percentile 96%

Public exploits

none known

A remote code execution vulnerability exists in the way affected Microsoft scripting engine render when handling objects in memory in Microsoft browsers. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the current user. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user, aka "Scripting Engine Memory Corruption Vulnerability."

Exploit prediction (EPSS)

10.81% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

CVSS scores

Assigned by	Version	Score	Vector
NVD	3.0	8.1	`CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`
NVD	2.0	9.3	`AV:N/AC:M/Au:N/C:C/I:C/A:C`

Affected products

Microsoft Corporation Microsoft ChakraCore

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

github.com /Microsoft/ChakraCore/commit/9da019424601325a6e95e6be0fa03d7d21d0b517 · x_refsource_CONFIRM, x_transferred

Sources

CVE List: CVE-2017-0152
NVD: CVE-2017-0152

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.