CVE-2018-0933: Chakra scripting engine out-of-bounds write enables remote code execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 19 September 2026. Confidence: high.

high priorityCVSS 7.5, public exploit code, and very high EPSS (0.663) make this a high-priority patching target despite no KEV listing.

What it is

CVE-2018-0933 is a memory corruption flaw (CWE-787 out-of-bounds write) in how the Chakra scripting engine handles objects in memory, affecting ChakraCore and multiple Windows 10 versions plus Windows Server 2016. Successful exploitation allows remote code execution in the context of the affected process, making it a serious browser-engine issue for unpatched systems.

Impact

An attacker who triggers the flaw can execute arbitrary code in the context of the current user, potentially leading to full system compromise if the user has administrative rights.

Attack surface

The vulnerability is network-reachable (AV:N) and requires user interaction (UI:R), typically by visiting a crafted web page or opening malicious content that invokes the Chakra engine; no privileges are required (PR:N).

Exploitation

A public exploit exists (Exploit-DB 44396) and EPSS is high at 0.663 (99.2nd percentile), though the CVE is not listed in CISA KEV.

What to do

• Apply the Microsoft security update referenced in the MSRC advisory for CVE-2018-0933 as the first action.
• Upgrade or retire unsupported Windows 10 builds (Gold, 1511, 1607, 1703, 1709) and Windows Server 2016 to a patched level.
• If ChakraCore is embedded in applications, update it to a fixed release or disable the scripting engine where not needed.
• Enforce browser hardening such as disabling JScript/legacy script engines and restricting untrusted web content via network controls.

Detection

• Monitor for crashes or abnormal process terminations in browsers and ChakraCore hosts that could indicate memory corruption attempts.
• Hunt for known exploit artifacts or shellcode patterns associated with Exploit-DB 44396 in endpoint telemetry.
• Review proxy and DNS logs for access to known exploit-hosting or malicious pages targeting the Chakra engine.
• Correlate endpoint alerts for suspicious child processes spawned by browsers or script hosts on unpatched Windows 10/Server 2016 systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.