Read the docs
TI-2020-00787 Aliases CVE-2020-0812GHSA-g67x-mgrv-m3gv

Out-of-bounds write in Microsoft ChakraCore

Priority MEDIUM 43CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-787 and the CVSS impact.

Summary

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based)L, aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2020-0811.

Why it matters now

EPSS 0.07871 94th percentileScored 2026-11-07
Fix Fixed Microsoft.ChakraCore (NuGet): 1.11.17

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftChakraCoreall versions—No fix listedCNA
MicrosoftMicrosoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for 32-bit Systemsall versions—No fix listedCNA
MicrosoftMicrosoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for x64-based Systemsall versions—No fix listedCNA
MicrosoftMicrosoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for ARM64-based Systemsall versions—No fix listedCNA
MicrosoftMicrosoft Edge (EdgeHTML-based) on Windows Server 2019all versions—No fix listedCNA
MicrosoftMicrosoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for 32-bit Systemsall versions—No fix listedCNA
MicrosoftMicrosoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for x64-based Systemsall versions—No fix listedCNA
MicrosoftMicrosoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for ARM64-based Systemsall versions—No fix listedCNA
MicrosoftMicrosoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for 32-bit Systemsall versions—No fix listedCNA
MicrosoftMicrosoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for x64-based Systemsall versions—No fix listedCNA
MicrosoftMicrosoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for ARM64-based Systemsall versions—No fix listedCNA
—Microsoft.ChakraCore (NuGet)before 1.11.171.11.17Patch availableGHSA-g67x-mgrv-m3gv
  • ChakraCore VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for 32-bit Systems VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for x64-based Systems VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1809 for ARM64-based Systems VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
  • Microsoft Edge (EdgeHTML-based) on Windows Server 2019 VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for 32-bit Systems VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for x64-based Systems VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1909 for ARM64-based Systems VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for 32-bit Systems VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for x64-based Systems VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
  • Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1903 for ARM64-based Systems VendorMicrosoft Affected all versions Fixed in — No fix listed CNA
  • Microsoft.ChakraCore (NuGet) Vendor— Affected before 1.11.17 Fixed in 1.11.17 Patch available GHSA-g67x-mgrv-m3gv

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:chakracore:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*not specified by NVDVulnerableMicrosoft
cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:*1809Running onMicrosoft
cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:*1903Running onMicrosoft
cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:*1909Running onMicrosoft
cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:microsoft:chakracore:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:*:* Versions 1809 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:*:* Versions 1903 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:*:* Versions 1909 Running on ·Microsoft
  • cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · GHSA-g67x-mgrv-m3gv Microsoft.ChakraCore (NuGet) Fixed in 1.11.17 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-0812
  2. 2026-10-03 Alias added: GHSA-g67x-mgrv-m3gv

References

Patch 1

Advisory 1

Other 3

  • TI-2020-00848 Microsoft Browser Memory Corruption Vulnerability KEVCVSS 3.1HIGH 7.5
  • TI-2018-06000 Type confusion in Microsoft ChakraCore KEVCVSS 3.1HIGH 7.5
  • TI-2019-00333 Out-of-bounds write in Microsoft Edge CVSS 3.0HIGH 7.5
  • TI-2019-00359 Out-of-bounds write in Microsoft Edge CVSS 3.0HIGH 7.5
  • TI-2018-00721 Out-of-bounds write in Microsoft Edge CVSS 3.0HIGH 7.5
  • TI-2018-00720 Out-of-bounds write in Microsoft Edge CVSS 3.0HIGH 7.5
See all 254 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences