Read the docs
TI-2017-08804 Aliases CVE-2017-11858GHSA-w6f6-8p4j-54vr

Memory corruption in Microsoft ChakraCore, Microsoft Edge, Internet Explorer

Priority MEDIUM 44CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-119 and the CVSS impact.

Summary

ChakraCore and Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, and Microsoft Edge and Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709 allows an attacker to gain the same user rights as the current user, due to how Microsoft browsers handle objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11836, CVE-2017-11837, CVE-2017-11838, CVE-2017-11839, CVE-2017-11840, CVE-2017-11841, CVE-2017-11843, CVE-2017-11846, CVE-2017-11859, CVE-2017-11861, CVE-2017-11862, CVE-2017-11866, CVE-2017-11869, CVE-2017-11870, CVE-2017-11871, and CVE-2017-11873.

Why it matters now

EPSS 0.08358 94th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftChakraCore, Microsoft Edge, Internet ExplorerMicrosoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709.—No fix listedCNA
  • ChakraCore, Microsoft Edge, Internet Explorer VendorMicrosoft Affected Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, 1709, Windows Server 2016 and Windows Server, version 1709. Fixed in — No fix listed CNA

CPE configurations NVD · 17

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:a:microsoft:internet_explorer:*:*:*:*:*:*:*:*all versionsVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*r2 sp1Running onMicrosoft
cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*r2Running onMicrosoft
cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*all versionsVulnerableMicrosoft
  • cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:internet_explorer:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* Versions r2 sp1 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* Versions r2 Running on ·Microsoft
  • cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Microsoft
Show 7 more CPE
CPEVersionsRoleVendor
cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*1511Running onMicrosoft
cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*1607Running onMicrosoft
cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*1703Running onMicrosoft
cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*1709Running onMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*all versionsRunning onMicrosoft
cpe:2.3:o:microsoft:windows_server_2016:1709:*:*:*:*:*:*:*1709Running onMicrosoft
  • cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:* Versions 1511 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:* Versions 1607 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:* Versions 1703 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:* Versions 1709 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2016:1709:*:*:*:*:*:*:* Versions 1709 Running on ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-11858
  2. 2026-10-03 Alias added: GHSA-w6f6-8p4j-54vr

References

Patch 1

  • TI-2020-00848 Microsoft Browser Memory Corruption Vulnerability KEVCVSS 3.1HIGH 7.5
  • TI-2018-06000 Type confusion in Microsoft ChakraCore KEVCVSS 3.1HIGH 7.5
  • TI-2019-00333 Out-of-bounds write in Microsoft Edge CVSS 3.0HIGH 7.5
  • TI-2019-00359 Out-of-bounds write in Microsoft Edge CVSS 3.0HIGH 7.5
  • TI-2018-00721 Out-of-bounds write in Microsoft Edge CVSS 3.0HIGH 7.5
  • TI-2018-00720 Out-of-bounds write in Microsoft Edge CVSS 3.0HIGH 7.5
See all 254 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences