{"id":"CVE-2019-0567","published":"2019-01-08T21:00:00Z","modified":"2024-08-04T17:51:26Z","title":"A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in…","vendor":"Microsoft","product":"Microsoft Edge","tier":"core","eol":null,"affectedVersions":[{"vendor":"Microsoft","product":"Microsoft Edge","versions":["Windows 10 for 32-bit Systems","Windows 10 for x64-based Systems","Windows 10 Version 1607 for 32-bit Systems","Windows 10 Version 1607 for x64-based Systems","Windows 10 Version 1703 for 32-bit Systems","Windows 10 Version 1703 for x64-based Systems","Windows 10 Version 1709 for 32-bit Systems","Windows 10 Version 1709 for ARM64-based Systems","Windows 10 Version 1709 for x64-based Systems","Windows 10 Version 1803 for 32-bit Systems"]},{"vendor":"Microsoft","product":"ChakraCore","versions":["ChakraCore"]}],"description":{"text":"A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka \"Chakra Scripting Engine Memory Corruption Vulnerability.\" This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0539, CVE-2019-0568.","provenance":"source","from":"CVE.org"},"summary":{"text":"A memory corruption flaw in the way Microsoft Edge's Chakra scripting engine (and ChakraCore) handles objects in memory allows remote code execution. The provided details do not specify the attack vector, authentication, user interaction, or configuration required to trigger it.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:14:48Z"},"cvss":null,"epss":{"score":0.80126,"percentile":0.99615,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":{"pulseCount":4,"pulses":[{"name":"ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.","url":"https://otx.alienvault.com/pulse/69fdc02bea1e4ec923b01688","created":"2026-05-08"},{"name":"IOC's found on my pesonal devices; week starting 08/14/23","url":"https://otx.alienvault.com/pulse/65709ffcf3ffe737f8cb8dfd","created":"2023-12-06"},{"name":"IOC's found on my pesonal devices; week starting 08/14/23","url":"https://otx.alienvault.com/pulse/64dd9c1d76a7807782a691d3","created":"2023-08-17"},{"name":"Proof Point Emerging Exploit list","url":"https://otx.alienvault.com/pulse/6399fdc966948f6b537b9762","created":"2022-12-14"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://www.exploit-db.com/exploits/46203/","tags":["exploit","x_refsource_EXPLOIT-DB"]},{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0567","tags":["x_refsource_CONFIRM"]},{"url":"http://www.securityfocus.com/bid/106418","tags":["vdb-entry","x_refsource_BID"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"NuGet","package":"Microsoft.ChakraCore","vulnerableRanges":["<1.11.5"],"patched":["1.11.5"],"from":["GHSA-6x4f-5v4h-r29j"],"provenance":"source"}],"advisories":[{"id":"GHSA-6x4f-5v4h-r29j","url":"https://github.com/advisories/GHSA-6x4f-5v4h-r29j","severity":"HIGH","ecosystem":"NuGet","package":"Microsoft.ChakraCore","vulnerableRanges":["<1.11.5"],"patched":["1.11.5"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2022-2874","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-2874","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":46203,"url":"https://www.exploit-db.com/exploits/46203","title":"Microsoft Edge Chakra - 'NewScObjectNoCtor' or 'InitProto' Type Confusion","type":"dos","platform":"windows","date":"2019-01-18","verified":true,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2019-01-18"},"pocGithub":{"count":4,"skipped":0,"earliest":"2023-11-19","earliestUrl":"https://github.com/NatteeSetobol/Chakra-CVE-2019-0567","repos":[{"name":"ntdelta/chakra-exploit-framework","url":"https://github.com/ntdelta/chakra-exploit-framework","stars":1,"created":"2025-02-15"},{"name":"NatteeSetobol/Chakra-CVE-2019-0567","url":"https://github.com/NatteeSetobol/Chakra-CVE-2019-0567","stars":0,"created":"2023-11-19"},{"name":"NatteeSetobol/CVE-2019-0567-MS-Edge","url":"https://github.com/NatteeSetobol/CVE-2019-0567-MS-Edge","stars":0,"created":"2024-09-11"},{"name":"jamezx32/CVE-2019-0567","url":"https://github.com/jamezx32/CVE-2019-0567","stars":0,"created":"2026-10-14"}]},"first":{"date":"2019-01-18","source":"Exploit-DB","url":"https://www.exploit-db.com/exploits/46203"},"provenance":"source"},"exploitRefs":["https://www.exploit-db.com/exploits/46203/","https://www.exploit-db.com/exploits/46203"],"flow":[],"timeline":[{"date":"2019-01-08","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2019-0567","provenance":"source"},{"date":"2019-01-18","kind":"exploit-public","label":"First public exploit: Exploit-DB (EDB-46203); later: PoC-in-GitHub 2023-11-19","url":"https://www.exploit-db.com/exploits/46203","provenance":"source"}],"speed":{"daysToPublicExploit":10,"firstExploitFrom":"Exploit-DB","daysToKev":null},"priority":{"score":26.5,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.92,"detail":"percentile 0.9961"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 advisory exploit reference; 4 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":1.59,"detail":"4 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-microsoft-edge-cve-2019-0539","children":[{"from":"CVE-2019-0567","to":"CVE-2020-1073","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["lib/Backend/GlobOptFields.cpp"],"commits":["https://github.com/chakra-core/ChakraCore/commit/788f17b0ce06ea84553b123c174d1ff7052112a0","https://github.com/chakra-core/ChakraCore/commit/82d3c4556a3cba13f0115fc98a91263b15fa6d07"],"basis":"shared function","functions":["ProcessFieldKills"]}]}],"packageHistory":[{"cve":"CVE-2018-8618","published":"2018-12-12","fixed":"1.11.4","kev":false,"link":{"from":"CVE-2018-8618","to":"CVE-2019-0567","relation":"successor","confidence":"medium","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"NuGet:Microsoft.ChakraCore","fromFixed":"1.11.4","toFixed":"1.11.5","daysApart":27},{"kind":"similar","provenance":"machine","score":1.0,"basis":"same product + description similarity"}]}},{"cve":"CVE-2018-8624","published":"2018-12-12","fixed":"1.11.4","kev":false},{"cve":"CVE-2018-8629","published":"2018-12-12","fixed":"1.11.4","kev":false},{"cve":"CVE-2019-0539","published":"2019-01-08","fixed":"1.11.5","kev":false},{"cve":"CVE-2019-0567","published":"2019-01-08","fixed":"1.11.5","kev":false},{"cve":"CVE-2019-0568","published":"2019-01-08","fixed":"1.11.5","kev":false},{"cve":"CVE-2019-0648","published":"2019-03-06","fixed":"1.11.6","kev":false},{"cve":"CVE-2019-0649","published":"2019-03-06","fixed":"1.11.6","kev":false}],"package":"NuGet:Microsoft.ChakraCore"}}