Chakra Scripting Engine Memory Corruption Vulnerability
Priority LOW 37CWE-787Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-787 and the CVSS impact.
Summary
Chakra Scripting Engine Memory Corruption Vulnerability
Why it matters now
EPSS 0.02045 81st percentileScored 2026-11-07
Fix Fixed ChakraCore (Microsoft): publicationMicrosoft Edge (EdgeHTML-based) (Microsoft): publication+1 more product
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Microsoft | ChakraCore | before publication | publication | Patch available | CNA |
| Microsoft | Microsoft Edge (EdgeHTML-based) | 1.0..0 to before publication | publication | Patch available | CNA |
| — | Microsoft.ChakraCore (NuGet) | before 1.11.24 | 1.11.24 | Patch available | GHSA-qwwg-gc55-qqrv |
- ChakraCore VendorMicrosoft Affected before publication Fixed in publication Patch available CNA
- Microsoft Edge (EdgeHTML-based) VendorMicrosoft Affected 1.0..0 to before publication Fixed in publication Patch available CNA
- Microsoft.ChakraCore (NuGet) Vendor— Affected before 1.11.24 Fixed in 1.11.24 Patch available GHSA-qwwg-gc55-qqrv
CPE configurations NVD · 18
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:arm64:* | 20h2 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x64:* | 20h2 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x86:* | 20h2 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:arm64:* | 1809 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x64:* | 1809 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x86:* | 1809 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:arm64:* | 1903 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:x64:* | 1903 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:x86:* | 1903 | Running on | Microsoft |
- cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:arm64:* Versions 20h2 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x64:* Versions 20h2 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x86:* Versions 20h2 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:arm64:* Versions 1809 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x64:* Versions 1809 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x86:* Versions 1809 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:arm64:* Versions 1903 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:x64:* Versions 1903 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1903:*:*:*:*:*:x86:* Versions 1903 Running on ·Microsoft
Show 8 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:arm64:* | 1909 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x64:* | 1909 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x86:* | 1909 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:arm64:* | 2004 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x64:* | 2004 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x86:* | 2004 | Running on | Microsoft |
| cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Microsoft |
| cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:* | before 1.11.0 | Vulnerable | Microsoft |
- cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:arm64:* Versions 1909 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x64:* Versions 1909 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x86:* Versions 1909 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:arm64:* Versions 2004 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x64:* Versions 2004 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_10:2004:*:*:*:*:*:x86:* Versions 2004 Running on ·Microsoft
- cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft
- cpe:2.3:a:microsoft:chakracore:*:*:*:*:*:*:*:* Versions before 1.11.0 Vulnerable ·Microsoft
Remediation
- Fix · CNA ChakraCore (Microsoft) Fixed in publication
- Fix · CNA Microsoft Edge (EdgeHTML-based) (Microsoft) Fixed in publication
- Fix · GHSA-qwwg-gc55-qqrv Microsoft.ChakraCore (NuGet) Fixed in 1.11.24 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2020-17131
- 2026-10-03 Alias added: GHSA-qwwg-gc55-qqrv
References
Patch 2
More Microsoft Chakracore vulnerabilities
- TI-2020-00848 Microsoft Browser Memory Corruption Vulnerability KEVCVSS 3.1HIGH 7.5
- TI-2018-06000 Type confusion in Microsoft ChakraCore KEVCVSS 3.1HIGH 7.5
- TI-2019-00333 Out-of-bounds write in Microsoft Edge CVSS 3.0HIGH 7.5
- TI-2019-00359 Out-of-bounds write in Microsoft Edge CVSS 3.0HIGH 7.5
- TI-2018-00721 Out-of-bounds write in Microsoft Edge CVSS 3.0HIGH 7.5
- TI-2018-00720 Out-of-bounds write in Microsoft Edge CVSS 3.0HIGH 7.5
Sources
- CVE-2020-17131 · CVE Program
- CVE-2020-17131 · NVD
- FIRST EPSS
- GHSA-qwwg-gc55-qqrv · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences