CVE-2018-0767: Microsoft Edge scripting engine out-of-bounds read leaks memory

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityPublic exploit code and a very high EPSS score raise the likelihood of exploitation despite the medium CVSS base score and high attack complexity.

What it is

Microsoft Edge and ChakraCore mishandle objects in memory in the scripting engine, causing an out-of-bounds read (CWE-125). The flaw is an information disclosure issue that affects Windows 10 versions 1511, 1607, 1703, 1709 and Windows Server 2016. It matters because leaked memory contents can reveal data useful for building further exploits against the browser.

Impact

An attacker who triggers the bug can read out-of-bounds memory, obtaining information to further compromise the user's system. The CVSS vector shows confidentiality impact only, with no integrity or availability effect.

Attack surface

Reached over the network through the Edge scripting engine, requiring user interaction (UI:R) such as visiting a crafted page, and no privileges (PR:N). The high attack complexity (AC:H) indicates exploitation depends on conditions that are not fully under the attacker's control.

Exploitation

CISA KEV does not list this CVE, but EPSS is high at 0.65467 (99.2nd percentile) and a public Exploit-DB entry (43522) exists, so exploit code is publicly available. No ransomware group is documented as using it.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0767 as the first action.
• Upgrade or migrate off the affected Windows 10 builds (1511, 1607, 1703, 1709) and Windows Server 2016 where feasible.
• Keep Edge and ChakraCore patched and enforce automatic updates for browser components.
• Reduce exposure by restricting browsing to trusted sites and blocking known exploit hosts at the network edge.

Detection

• Monitor for Edge or ChakraCore crashes consistent with out-of-bounds reads in the scripting engine.
• Hunt for processes loading Edge/ChakraCore modules followed by unexpected network callbacks or child processes.
• Review proxy and DNS logs for access to hosts associated with the public Exploit-DB proof of concept.
• Correlate browser process anomalies with subsequent credential or data access attempts on the same host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.