Memory corruption in Microsoft Edge
Priority MEDIUM 57CWE-119Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-119 and the CVSS impact.
Summary
A remote code execution vulnerability exists in Microsoft Edge in the way that the Chakra JavaScript engine renders when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability." This CVE ID is unique from CVE-2017-0224, CVE-2017-0228, CVE-2017-0229, CVE-2017-0230, CVE-2017-0234, CVE-2017-0235, and CVE-2017-0238.
Why it matters now
EPSS 0.31582 98th percentileScored 2026-11-07
Fix Fixed Microsoft.ChakraCore (NuGet): 1.4.4
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | Microsoft Edge | Windows 10 for 32-bit Systems, Windows 10 for x64-based Systems, Windows 10 Version 1511 for 32-bit Systems, Windows 10 Version 1511 for x64-based Systems, Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1703 for 32-bit Systems, and Windows 10 Version 1703 for x64-based Systems. | — | No fix listed | CNA |
| — | Microsoft.ChakraCore (NuGet) | before 1.4.4 | 1.4.4 | Patch available | GHSA-p3rw-88pp-w4jh |
- Microsoft Edge VendorMicrosoft Affected Windows 10 for 32-bit Systems, Windows 10 for x64-based Systems, Windows 10 Version 1511 for 32-bit Systems, Windows 10 Version 1511 for x64-based Systems, Windows 10 Version 1607 for 32-bit Systems, Windows 10 Version 1607 for x64-based Systems, Windows 10 Version 1703 for 32-bit Systems, and Windows 10 Version 1703 for x64-based Systems. Fixed in — No fix listed CNA
- Microsoft.ChakraCore (NuGet) Vendor— Affected before 1.4.4 Fixed in 1.4.4 Patch available GHSA-p3rw-88pp-w4jh
Remediation
- Fix · GHSA-p3rw-88pp-w4jh Microsoft.ChakraCore (NuGet) Fixed in 1.4.4 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-0236
- 2026-10-03 Alias added: GHSA-p3rw-88pp-w4jh
References
Other 5
- https://github.com/chakra-core/ChakraCore/pull/2959
- https://github.com/chakra-core/ChakraCore/commit/1ae7e3ce95515758b4cd7215cb4e48539a0f4031
- https://github.com/chakra-core/ChakraCore
- https://web.archive.org/web/20210125194440/http://www.securityfocus.com/bid/98234
- https://web.archive.org/web/20211019191652/http://www.securitytracker.com/id/1038431
More Microsoft Edge vulnerabilities
- TI-2024-07390 Type confusion in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2022-03781 Out-of-bounds write in Google Chrome KEVCVSS 3.1CRITICAL 9.6
- TI-2015-00277 Use-after-free vulnerability in Adobe Flash Player before 13.0.0.269 and 14.x through… KEVCVSS 3.1CRITICAL 9.8
- TI-2015-00275 Unspecified vulnerability in Adobe Flash Player through 13.0.0.262 and 14.x, 15.x, and… KEVCVSS 3.1CRITICAL 9.8
- TI-2023-04799 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
- TI-2020-12621 Out-of-bounds write in Google Chrome KEVCVSS 3.1HIGH 8.8
Sources
- CVE-2017-0236 · CVE Program
- CVE-2017-0236 · NVD
- FIRST EPSS
- GHSA-p3rw-88pp-w4jh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences