CVE-2017-11918

This vulnerability is in the JavaScript (scripting) engine used by Microsoft Edge. An attacker can use a specially crafted input to corrupt memory and then run code as the same user currently logged into Windows. Think of it like breaking into a locked room and then using the privileges of whoever is already inside the building.

This matters if you run Microsoft Edge on Windows 10 Gold (1511, 1607, 1703, 1709) or Windows Server 2016 where ChakraCore is present. If a user visits a maliciously prepared page or content that triggers the bug, the attacker can act with that user’s permissions. The exposure is only a real risk when the vulnerable Edge/ChakraCore code path is reachable on the affected Windows versions, and attackers have a way to get the victim to load the triggering content.

This is an AMBER issue because there is a public exploit available and attackers can gain control under the current user’s permissions. While it’s not listed in the CISA KEV and exploitation isn’t confirmed by KEV here, the availability of weaponized code makes timely patching important. Press attention is rising, but the decisive factor for urgency is the known public exploit.

1. Confirm exposure

• Identify which machines are on: Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016.
• On those machines, confirm that Microsoft Edge is installed/used and that ChakraCore is part of your Edge/javascript engine environment.
• Check the installed ChakraCore version so you can compare against the fixed release (ChakraCore 1.7.5).

2. Remediate

• Upgrade ChakraCore to 1.7.5 (fixed in 1.7.5).
• Use the Microsoft advisory guidance for CVE-2017-11918 to ensure the correct remediation is applied for your environment.

3. If patching is delayed

• Apply the Microsoft vendor security update/advisory steps for CVE-2017-11918 as soon as possible (Microsoft remediation guidance is linked below).
• In the interim, reduce risk by restricting access to untrusted web content in the browsers you use (especially for users who frequently browse the internet).

4. Verify

• After updates, re-check the ChakraCore version is on/above the fixed state (1.7.5) and that the Microsoft advisory remediation is reflected on the system.
• Review relevant browser/system logs for signs of exploitation attempts during the window before the update.

5. Reference

• Microsoft advisory/patch guidance: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11918

KEV note

• This CVE is not listed in the CISA KEV based on the provided findings, so there is no KEV-specific deadline mentioned here.

Severity is indicated as HIGH (CVSS 7.5) and the weakness is categorized as CWE-119 (improper memory handling).

Mechanism: The ChakraCore scripting engine and Microsoft Edge have a memory corruption issue in how objects are handled in memory. With crafted input delivered through Edge, an attacker can trigger memory corruption and gain code execution in the context of the currently logged-in user, effectively matching that user’s rights.

Exploit status: A public exploit is available (weaponized). The findings do not list this CVE in CISA KEV.

Likelihood indicators: EPSS is provided as a prediction only; it is not used to drive action beyond the presence of a public exploit.

Fix: ChakraCore is fixed in 1.7.5. Follow the linked Microsoft advisory for the correct remediation steps for your Windows version and Edge/ChakraCore installation.