CVE-2018-0939 ChakraCore information disclosure vulnerability

What is CVE-2018-0939?

CVE-2018-0939 is a medium-severity vulnerability in Microsoft Edge, published on 14 Mar 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

ChakraCore and Microsoft Edge in Windows 10 1703 and 1709 allow information disclosure, due to how the scripting engine handles objects in memory, aka "Scripting Engine Information Disclosure Vulnerability". This CVE ID is unique from CVE-2018-0891.

Weakness: CWE-787

Which versions are affected by CVE-2018-0939?

2 open source packages ship an affected version, including Microsoft.ChakraCore. It affects 1 product.

Products include Microsoft Edge.

How do I fix CVE-2018-0939?

Upgrade Microsoft.ChakraCore to 1.8.2 or later.

Is CVE-2018-0939 being exploited?

There is no known exploitation of CVE-2018-0939 in the wild and no public exploit code.

Other vulnerabilities in Microsoft Edge

• CVE-2021-26411 Microsoft Internet Explorer Memory Corruption Exploited High 8.8
• CVE-2016-7200 Microsoft Edge Memory Corruption Exploited High 8.8
• CVE-2016-7201 Microsoft Edge Memory Corruption Exploited High 8.8
• CVE-2017-0037 Microsoft Edge and Internet Explorer Type Confusion Exploited High 8.1
• CVE-2016-3351 Microsoft Internet Explorer and Edge Information Disclosure Exploited Medium 6.5

All Microsoft Edge vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xgcc-r2f3-rq6p.