CVE-2018-1022

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting Engine Memory Corruption Vulnerability." This affects ChakraCore, Internet Explorer 11, Microsoft Edge. This CVE ID is unique from CVE-2018-0945, CVE-2018-0946, CVE-2018-0951, CVE-2018-0953, CVE-2018-0954, CVE-2018-0955, CVE-2018-8114, CVE-2018-8122, CVE-2018-8128, CVE-2018-8137, CVE-2018-8139.

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

VendorProductVersions
MicrosoftChakraCoreChakraCore
MicrosoftInternet Explorer 11Windows 10 for 32-bit Systems; Windows 10 for x64-based Systems; Windows 10 Version 1607 for 32-bit Systems; Windows 10 Version 1607 for x64-based Systems; Windows 10 Version 1703 for 32-bit Systems; Windows 10 Version 1703 for x64-based Systems; Windows 10 Version 1709 for 32-bit Systems; Windows 10 Version 1709 for x64-based Systems; Windows 10 Version 1803 for 32-bit Systems; Windows 10 Version 1803 for x64-based Systems; Windows 7 for 32-bit Systems Service Pack 1; Windows 7 for x64-based Systems Service Pack 1; Windows 8.1 for 32-bit systems; Windows 8.1 for x64-based systems; Windows RT 8.1; Windows Server 2008 R2 for x64-based Systems Service Pack 1; Windows Server 2012 R2; Windows Server 2016
MicrosoftMicrosoft EdgeWindows 10 for 32-bit Systems; Windows 10 for x64-based Systems; Windows 10 Version 1607 for 32-bit Systems; Windows 10 Version 1607 for x64-based Systems; Windows 10 Version 1703 for 32-bit Systems; Windows 10 Version 1703 for x64-based Systems; Windows 10 Version 1709 for 32-bit Systems; Windows 10 Version 1709 for x64-based Systems; Windows 10 Version 1803 for 32-bit Systems; Windows 10 Version 1803 for x64-based Systems; Windows Server 2016

References

Timeline

Published
May 9, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2018

CVE-2018-102208.8Glastopf 3.1.3-dev has SSRF, as demonstrated by the abc.php a parameter. NOTE: the vendor indicates that this is intentional behavior becausCVE-2018-102215.4An issue was discovered in WUZHI CMS V4.1.0. There is a persistent XSS vulnerability that can steal the administrator cookies via the tag[taCVE-2018-102228.8An issue was discovered in idreamsoft iCMS V7.0. There is a CSRF vulnerability that can add a Column via /admincp.php?app=article_category&dCVE-2018-102236.8An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add an admin account via /index.php/admin/admin_manage/add.htmCVE-2018-102246.8An issue was discovered in YzmCMS 3.8. There is a CSRF vulnerability that can add a tag via /index.php/admin/tag/add.html.CVE-2018-102259.8thinkphp 3.1.3 has SQL Injection via the index.php s parameter.CVE-2018-102275.4MiniCMS v1.10 has XSS via the mc-admin/conf.php site_link parameter.CVE-2018-102286.1Cross-site scripting (XSS) vulnerability in /application/controller/admin/theme.php in LimeSurvey 3.6.2+180406 allows remote attackers to inCVE-2018-102294.8A hardware vulnerability in GPU memory modules allows attackers to accelerate micro-architectural attacks through the use of the JavaScript CVE-2018-10237.5A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory, aka "Microsoft Browser Memory CorrCVE-2018-102306.1Zend Debugger in Zend Server before 9.1.3 has XSS, aka ZSR-2455.CVE-2018-102316.1Cross-site scripting (XSS) vulnerability in TOPdesk before 8.05.017 (June 2018 version) and before 5.7.SR9 allows remote attackers to inject
CVE-2018-1022: High severity, CVSS 7.5 | Vulnix