{"id":"CVE-2019-0568","published":"2019-01-08T21:00:00Z","modified":"2024-08-04T17:51:26Z","title":"A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in…","vendor":"Microsoft","product":"Microsoft Edge","tier":"core","eol":null,"affectedVersions":[{"vendor":"Microsoft","product":"Microsoft Edge","versions":["Windows 10 Version 1803 for 32-bit Systems","Windows 10 Version 1803 for ARM64-based Systems","Windows 10 Version 1803 for x64-based Systems","Windows 10 Version 1809 for 32-bit Systems","Windows 10 Version 1809 for ARM64-based Systems","Windows 10 Version 1809 for x64-based Systems","Windows Server 2019"]},{"vendor":"Microsoft","product":"ChakraCore","versions":["ChakraCore"]}],"description":{"text":"A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka \"Chakra Scripting Engine Memory Corruption Vulnerability.\" This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0539, CVE-2019-0567.","provenance":"source","from":"CVE.org"},"summary":{"text":"A remote code execution flaw in Microsoft Edge's Chakra scripting engine stems from how the engine handles objects in memory, resulting in a memory corruption vulnerability that also affects ChakraCore. An attacker could execute arbitrary code by exploiting this memory handling flaw; the available record does not specify the required access, authentication, or user interaction conditions.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:16:24Z"},"cvss":null,"epss":{"score":0.69455,"percentile":0.99358,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":1,"pulses":[{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0568","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/106420","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://www.exploit-db.com/exploits/46205/","tags":["exploit","x_refsource_EXPLOIT-DB"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"NuGet","package":"Microsoft.ChakraCore","vulnerableRanges":["<1.11.5"],"patched":["1.11.5"],"from":["GHSA-2m5h-6g38-jjf2"],"provenance":"source"}],"advisories":[{"id":"GHSA-2m5h-6g38-jjf2","url":"https://github.com/advisories/GHSA-2m5h-6g38-jjf2","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.ChakraCore","vulnerableRanges":["<1.11.5"],"patched":["1.11.5"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-2008","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2008","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":46205,"url":"https://www.exploit-db.com/exploits/46205","title":"Microsoft Edge Chakra - 'JsBuiltInEngineInterfaceExtensionObject::InjectJsBuiltInLibraryCode' Use-After-Free","type":"dos","platform":"windows","date":"2019-01-18","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2019-01-18"},"first":{"date":"2019-01-18","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/46205"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/46205/","https://www.exploit-db.com/exploits/46205"],"flow":[],"timeline":[{"date":"2019-01-08","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-0568","provenance":"source"},{"date":"2019-01-18","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-46205)","url":"https://www.exploit-db.com/exploits/46205","provenance":"source"}],"speed":{"daysToPublicExploit":10,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":25.6,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.87,"detail":"percentile 0.9936"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 advisory exploit reference"},{"name":"Mentioned in OTX pulses","points":0.68,"detail":"1 pulse"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"packageHistory":[{"cve":"CVE-2018-8618","published":"2018-12-12","fixed":"1.11.4","kev":false,"link":{"from":"CVE-2018-8618","to":"CVE-2019-0568","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.ChakraCore","fromFixed":"1.11.4","toFixed":"1.11.5","daysApart":27},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + description similarity"}]}},{"cve":"CVE-2018-8629","published":"2018-12-12","fixed":"1.11.4","kev":false},{"cve":"CVE-2019-0539","published":"2019-01-08","fixed":"1.11.5","kev":false},{"cve":"CVE-2019-0567","published":"2019-01-08","fixed":"1.11.5","kev":false},{"cve":"CVE-2019-0568","published":"2019-01-08","fixed":"1.11.5","kev":false},{"cve":"CVE-2019-0648","published":"2019-03-06","fixed":"1.11.6","kev":false,"link":{"from":"CVE-2019-0568","to":"CVE-2019-0648","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.ChakraCore","fromFixed":"1.11.5","toFixed":"1.11.6","daysApart":57},{"kind":"similar","provenance":"machine","score":0.46,"basis":"same product + description similarity"}]}},{"cve":"CVE-2019-0649","published":"2019-03-06","fixed":"1.11.6","kev":false,"link":{"from":"CVE-2019-0568","to":"CVE-2019-0649","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.ChakraCore","fromFixed":"1.11.5","toFixed":"1.11.6","daysApart":57},{"kind":"similar","provenance":"machine","score":0.5,"basis":"same product + description similarity"}]}},{"cve":"CVE-2019-0592","published":"2019-04-08","fixed":"1.11.7","kev":false}],"package":"NuGet:Microsoft.ChakraCore"}}