CVE-2019-0567 Public exploit EPSS 80.1%

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in…

Microsoft · Microsoft Edge

Summary

A memory corruption flaw in the way Microsoft Edge's Chakra scripting engine (and ChakraCore) handles objects in memory allows remote code execution. The provided details do not specify the attack vector, authentication, user interaction, or configuration required to trigger it.

Official description · CVE.org

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2019-0539, CVE-2019-0568.

Breakdown

26.5 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Public exploit code (Exploit-DB) appeared 10 days after disclosure. No confirmed exploitation is recorded.

Disclosed8 Jan 2019day 0
Public exploit codeExploit-DB18 Jan 2019+10 days

See the family tree

4 related vulnerabilities in the same code over 22 months. The latest fix listed for Microsoft.ChakraCore is 1.11.6.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

CVE-2019-0539A remote code execution vulnerability exists in the way that the…8 Jan 2019
same family
This CVECVE-2019-0567A remote code execution vulnerability exists in the way that the…8 Jan 2019
relatedMedium
Why these are linked:
- Same code patched: GlobOptFields.cpp (machine-matched)Functions: ProcessFieldKillscommit 788f17b commit 82d3c45
CVE-2020-1073A remote code execution vulnerability exists in the way that the…9 Jun 2020
relatedMedium
Why these are linked:
- Same code patched: Lower.cpp (machine-matched)commit 82d3c45 commit e81e8a5
CVE-2020-17054Chakra Scripting Engine Memory Corruption11 Nov 2020

Fixes in Microsoft.ChakraCoreNuGet package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

1.11.4CVE-2018-861812 Dec 2018
1.11.4CVE-2018-862412 Dec 2018
1.11.4CVE-2018-862912 Dec 2018
1.11.5CVE-2019-05398 Jan 2019
1.11.5CVE-2019-05678 Jan 2019
1.11.5CVE-2019-05688 Jan 2019
1.11.6CVE-2019-06486 Mar 2019
1.11.6CVE-2019-06496 Mar 2019Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: Microsoft.ChakraCore.

NuGetMicrosoft.ChakraCoreGHSA-6x4f-5v4h-r29j

Upgrade to 1.11.11 or later

Fixes this CVE and 44 other known vulnerabilities in this package (CVE-2016-0191, CVE-2016-0193, +42).

Set the version to 1.11.11 or later in your .csproj.

First fixed in 1.11.5 for CVE-2019-0567.

Affected versions

If you run	Upgrade to
All versions before 1.11.5	1.11.11first fix for this CVE: 1.11.5

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 4 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

ripe.arin.enom.cpanel.cpcalendar.iana.networksolutions.02050.webdisk.webmail.8 May 2026
IOC's found on my pesonal devices; week starting 08/14/236 Dec 2023
IOC's found on my pesonal devices; week starting 08/14/2317 Aug 2023
Proof Point Emerging Exploit list14 Dec 2022

References

3 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2022-2874

Microsoft Edge Chakra - 'NewScObjectNoCtor' or 'InitProto' Type ConfusionEDB-46203 · dos · windows · 2019-01-18 · verified

, 30 Oct 2026

80.1%Top 0.38%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.62%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9962 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 NVD reference tagged Exploit; 1 Exploit-DB entry; 1 advisory exploit reference; 4 PoC-in-GitHub repos 5.0/5

Mentioned in OTX pulses4 pulses 1.6/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total26.5

Record

Published: 8 Jan 2019
Modified: 4 Aug 2024
: None assigned
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in Microsoft.ChakraCoreNuGet package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions

What security researchers reported

Also mentioned in 4 community threat pulses (AlienVault OTX)

References

exploit 1

x_refsource_CONFIRM 1

vdb-entry 1

techniques