{"id":"CVE-2019-0539","published":"2019-01-08T21:00:00Z","modified":"2024-08-04T17:51:26Z","title":"A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in…","vendor":"Microsoft","product":"Microsoft Edge","tier":"core","eol":null,"affectedVersions":[{"vendor":"Microsoft","product":"Microsoft Edge","versions":["Windows 10 for 32-bit Systems","Windows 10 for x64-based Systems","Windows 10 Version 1607 for 32-bit Systems","Windows 10 Version 1607 for x64-based Systems","Windows 10 Version 1703 for 32-bit Systems","Windows 10 Version 1703 for x64-based Systems","Windows 10 Version 1709 for 32-bit Systems","Windows 10 Version 1709 for ARM64-based Systems","Windows 10 Version 1709 for x64-based Systems","Windows 10 Version 1803 for 32-bit Systems"]},{"vendor":"Microsoft","product":"ChakraCore","versions":["ChakraCore"]}],"description":{"text":"A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka \"Chakra Scripting Engine Memory Corruption Vulnerability.\" This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0567, CVE-2019-0568.","provenance":"source","from":"CVE.org"},"summary":{"text":"A memory corruption flaw in the way the Chakra scripting engine handles objects in memory affects Microsoft Edge and ChakraCore. An attacker can achieve remote code execution by exploiting this flaw.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:18:51Z"},"cvss":null,"epss":{"score":0.82902,"percentile":0.9967,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":0,"pulses":[],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.exploit-db.com/exploits/46204/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://www.exploit-db.com/exploits/46485/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"http://www.securityfocus.com/bid/106401","tags":["vdb-entry","x_refsource_BID"]},{"url":"https://www.exploit-db.com/exploits/46203/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0539","tags":["x_refsource_CONFIRM"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"NuGet","package":"Microsoft.ChakraCore","vulnerableRanges":["<1.11.5"],"patched":["1.11.5"],"from":["GHSA-3w4v-qfqc-3433"],"provenance":"source"}],"advisories":[{"id":"GHSA-3w4v-qfqc-3433","url":"https://github.com/advisories/GHSA-3w4v-qfqc-3433","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.ChakraCore","vulnerableRanges":["<1.11.5"],"patched":["1.11.5"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-2251","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2251","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":46203,"url":"https://www.exploit-db.com/exploits/46203","title":"Microsoft Edge Chakra - 'NewScObjectNoCtor' or 'InitProto' Type Confusion","type":"dos","platform":"windows","date":"2019-01-18","verified":true,"provenance":"source"},{"id":46204,"url":"https://www.exploit-db.com/exploits/46204","title":"Microsoft Edge Chakra - 'InitClass' Type Confusion","type":"dos","platform":"windows","date":"2019-01-18","verified":true,"provenance":"source"},{"id":46485,"url":"https://www.exploit-db.com/exploits/46485","title":"Microsoft Edge Chakra 1.11.4 - Read Permission via Type Confusion","type":"dos","platform":"windows","date":"2019-03-04","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":3,"earliest":"2019-01-18"},"pocGithub":{"count":1,"skipped":0,"earliest":"2019-07-12","earliestUrl":"https://github.com/0x43434343/CVE-2019-0539","repos":[{"name":"0x43434343/CVE-2019-0539","url":"https://github.com/0x43434343/CVE-2019-0539","stars":4,"created":"2019-07-12"}]},"first":{"date":"2019-01-18","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/46203"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/46204/","https://www.exploit-db.com/exploits/46485/","https://www.exploit-db.com/exploits/46203/","https://www.exploit-db.com/exploits/46203","https://www.exploit-db.com/exploits/46204","https://www.exploit-db.com/exploits/46485"],"flow":[],"timeline":[{"date":"2019-01-08","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-0539","provenance":"source"},{"date":"2019-01-18","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-46203); later: PoC-in-GitHub 2019-07-12","url":"https://www.exploit-db.com/exploits/46203","provenance":"source"}],"speed":{"daysToPublicExploit":10,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":24.9,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.93,"detail":"percentile 0.9967"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 3 Exploit-DB entries; 3 advisory exploit references; 1 PoC-in-GitHub repo"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-microsoft-edge-cve-2019-0539","children":[{"from":"CVE-2019-0539","to":"CVE-2020-1073","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/Backend/GlobOptFields.cpp"],"commits":["https://github.com/chakra-core/ChakraCore/commit/788f17b0ce06ea84553b123c174d1ff7052112a0","https://github.com/chakra-core/ChakraCore/commit/82d3c4556a3cba13f0115fc98a91263b15fa6d07"],"basis":"shared function","functions":["ProcessFieldKills"]}]}],"packageHistory":[{"cve":"CVE-2018-8618","published":"2018-12-12","fixed":"1.11.4","kev":false,"link":{"from":"CVE-2018-8618","to":"CVE-2019-0539","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.ChakraCore","fromFixed":"1.11.4","toFixed":"1.11.5","daysApart":27},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + description similarity"}]}},{"cve":"CVE-2018-8624","published":"2018-12-12","fixed":"1.11.4","kev":false},{"cve":"CVE-2018-8629","published":"2018-12-12","fixed":"1.11.4","kev":false},{"cve":"CVE-2019-0539","published":"2019-01-08","fixed":"1.11.5","kev":false},{"cve":"CVE-2019-0567","published":"2019-01-08","fixed":"1.11.5","kev":false},{"cve":"CVE-2019-0568","published":"2019-01-08","fixed":"1.11.5","kev":false},{"cve":"CVE-2019-0648","published":"2019-03-06","fixed":"1.11.6","kev":false}],"package":"NuGet:Microsoft.ChakraCore"}}