CVE-2018-0780: Microsoft Edge scripting engine out-of-bounds read leaks memory

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: medium.

high priorityPublic exploit code exists and EPSS is very high, but the flaw is only an information disclosure requiring user interaction, so it is a strong enabler rather than direct code execution.

What it is

Microsoft Edge's scripting engine mishandles objects in memory, causing an out-of-bounds read (CWE-125) that discloses information. The flaw affects Edge on Windows 10 Gold, 1511, 1607, 1703, 1709 and Windows Server 2016, and Microsoft rates it medium severity. It matters because leaked memory contents can be used to weaken ASLR and build further exploits against the browser.

Impact

An attacker gains disclosure of memory contents from the browser process, which can reveal pointers and other data useful for bypassing mitigations. There is no integrity or availability impact; the value is in enabling follow-on compromise.

Attack surface

Reached over the network through a crafted web page that triggers the scripting engine's faulty object handling, requiring the victim to browse to attacker-controlled content (UI:R). No authentication or privileges are needed (PR:N), and the attack is rated high complexity (AC:H).

Exploitation

Not listed in CISA KEV, but an Exploit-DB entry (43720) tagged Exploit exists and EPSS is high at 0.586 (99th percentile), indicating meaningful real-world exploitation likelihood.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0780 as the first action.
• Upgrade or migrate off unsupported Windows 10 builds (Gold, 1511, 1607) and keep Edge/ChakraCore current.
• Enforce browser isolation or sandboxing for untrusted web content to limit memory disclosure value.
• Reduce reliance on legacy Edge by standardizing on a supported, actively patched browser where feasible.

Detection

• Monitor for Edge/ChakraCore crashes or abnormal process terminations that may indicate out-of-bounds read attempts.
• Hunt for known exploit artifacts or URLs associated with Exploit-DB 43720 in proxy and endpoint telemetry.
• Correlate suspicious script-heavy page loads with subsequent memory-scanning or second-stage payload activity on the host.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.