CVE-2018-0769: Microsoft Edge scripting engine memory corruption allows remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityRemote code execution in a widely deployed browser with public exploit code and very high EPSS, though it requires user interaction and a patch has long been available.

What it is

Microsoft Edge and ChakraCore mishandle objects in memory in the scripting engine, an out-of-bounds write (CWE-787) that corrupts memory. A remote attacker can trigger it through crafted content, and successful exploitation runs code in the context of the current user. It is one of a large batch of similar scripting engine flaws patched in January 2018.

Impact

An attacker gains arbitrary code execution with the privileges of the logged-in user, which on typical Windows 10 systems means full control of the user's session and data.

Attack surface

Reached over the network via a web page or other content rendered by the Edge scripting engine; the CVSS vector requires user interaction (UI:R) and no privileges (PR:N), so the victim must open or view the malicious content.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.78954, 99.57th percentile) and a public Exploit-DB entry (43710) exists, indicating exploit code is available.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0769 on all affected Windows 10 and Windows Server 2016 systems.
• Upgrade or remove unsupported Windows 10 builds (Gold, 1511) that no longer receive fixes.
• Keep Edge and ChakraCore patched and restrict use of legacy scripting components where feasible.
• Enforce email and web filtering to block delivery of exploit pages, and disable or restrict untrusted script content.
• Run users without administrative rights to limit the impact of code execution in the user context.

Detection

• Monitor for Edge or browser process crashes and abnormal child processes spawned from browser processes.
• Hunt for known exploit artifacts and shellcode patterns tied to Exploit-DB 43710 in web proxy or endpoint logs.
• Alert on outbound connections or process creation shortly after a user visits newly registered or low-reputation domains.
• Review endpoint telemetry for memory corruption indicators and unexpected script engine behavior on unpatched hosts.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.