CVE-2017-11767
9.8
CRITICAL · CVSS 3.0 · EPSS 9.5% (pctl 95)
In your normal cycle
Critical by CVSS (9.8), but no sign of active exploitation.
Description
ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".
Scoring
| CVSS | 9.8 (CRITICAL, v3.0) |
|---|---|
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | 9.51% — more likely to be exploited than 95% of all CVEs |
| Weakness | CWE-119 |
| On CISA KEV | no |
| Public exploit | none known |
| Published | 2017-11-02 |
| Last modified | 2026-06-17 |
Affected (1)
| Vendor | Product |
|---|---|
| microsoft | chakracore |
References
- http://www.securityfocus.com/bid/100838
- http://www.securitytracker.com/id/1039369
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11767
- http://www.securityfocus.com/bid/100838
- http://www.securitytracker.com/id/1039369
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11767
→ the Explorer · watch your stack · NVD