CVE-2018-0758: Microsoft Edge scripting engine memory corruption allows code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityCVSS 7.5 with a public exploit and very high EPSS make exploitation likely, though the required user interaction and the age of the affected platforms temper the rating.

What it is

Microsoft Edge and ChakraCore mishandle objects in memory in the scripting engine, producing an out-of-bounds write (CWE-787). A remote attacker can trigger memory corruption that leads to arbitrary code running in the context of the current user. The flaw affects Edge on Windows 10 Gold, 1511, 1607, 1703, 1709 and Windows Server 2016.

Impact

An attacker who lands the exploit gains code execution with the privileges of the logged-in user, enabling data theft, persistence or further compromise of the host. Because it is a browser scripting engine bug, the victim's own session and credentials are exposed.

Attack surface

Reached over the network through crafted web content rendered by the Edge scripting engine; the CVSS vector shows no privileges required but user interaction required (UI:R), so a victim must open or be directed to the malicious page. No authentication is needed.

Exploitation

CISA KEV does not list this CVE, but a public Exploit-DB entry (43491) exists and EPSS is very high at 0.808 (99.6th percentile), indicating substantial real-world exploitation likelihood.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0758 on all affected Windows 10 and Windows Server 2016 systems.
• Upgrade or remove unsupported Windows 10 builds (Gold, 1511) that no longer receive fixes.
• Restrict or disable the Edge/Chakra scripting engine where business use does not require it, and enforce browser hardening.
• Block known exploit hosts and untrusted web content at the network and email gateway layers.
• Run browsers with least privilege and keep exploit protection features such as ASLR and Control Flow Guard enabled.

Detection

• Monitor for Edge or ChakraCore crashes and abnormal process terminations on endpoints.
• Hunt for child processes spawned by Edge (for example script interpreters or command shells) that indicate post-exploitation.
• Review proxy and DNS logs for access to known exploit or malvertising infrastructure tied to this CVE.
• Alert on suspicious memory-write or heap corruption telemetry from browser processes where EDR coverage exists.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.