CVE-2018-0775: Microsoft Edge scripting engine memory corruption out-of-bounds write

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityPublic exploit code and a very high EPSS score make exploitation likely, but the need for user interaction and high attack complexity keep it below critical.

What it is

CVE-2018-0775 is a memory corruption flaw in the Microsoft Edge scripting engine (ChakraCore) on Windows 10 1709, caused by an out-of-bounds write (CWE-787) in how the engine handles objects in memory. Successful exploitation lets an attacker run arbitrary code in the context of the current user. It is one of a batch of similar scripting engine flaws patched in the same Microsoft update.

Impact

An attacker gains arbitrary code execution with the privileges of the logged-in user, which can lead to full system compromise if that user has administrative rights. The CVSS 3.0 vector rates confidentiality, integrity and availability impact all High.

Attack surface

Reached over the network (AV:N) but requires user interaction (UI:R), typically by luring a victim to a crafted web page or opening malicious content rendered by Edge. No authentication or privileges are needed (PR:N), and the high attack complexity (AC:H) reflects the effort needed to shape memory reliably.

Exploitation

A public exploit exists in Exploit-DB (reference tagged Exploit), and EPSS is high at 0.6787 (99.3rd percentile), though the CVE is not listed in CISA KEV. No ransomware group is documented as using it.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0775 as the first action.
• Upgrade or migrate off Windows 10 1709 and legacy Edge, which are no longer supported.
• Enforce browser isolation or block untrusted web content for users who cannot patch immediately.
• Reduce user privileges so code execution does not run with administrative rights.
• Keep ChakraCore-based components patched wherever they are embedded.

Detection

• Monitor for Edge or ChakraCore process crashes and abnormal memory access events on endpoints.
• Hunt for exploit-related network traffic or referrers matching known PoC delivery patterns.
• Alert on child processes spawned by the browser, such as script interpreters or command shells.
• Review Exploit-DB 43717 indicators against proxy and endpoint logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.