CVE-2018-0858: ChakraCore allows remote code execution, due to how the ChakraCore scripting engine handles objects in memo...

Security readout for executives and security teams

CVE-2018-0858 is a Microsoft ChakraCore scripting engine memory corruption flaw that could allow remote code execution. In business terms, affected systems may be at risk when they process untrusted script content through ChakraCore. The public bundle does not provide CVSS scoring, exploit details, or affected version boundaries. Exposure is most likely where Microsoft ChakraCore is used directly or embedded in an application that processes untrusted JavaScript or script-like content. The source bundle only names Microsoft ChakraCore, so no additional Microsoft products or third-party applications should be assumed affected without vendor confirmation. Treat as a high-priority legacy exposure review, not an active-exploitation emergency based on the supplied evidence. Prioritize confirming whether ChakraCore exists in supported products or internally maintained software, then patch or retire affected instances according to Microsoft guidance. Mitigation focus: Review the MSRC advisory for affected versions and vendor fixes.; Apply applicable Microsoft security updates or ChakraCore fixes.; Inventory applications that directly embed or package ChakraCore..

Prepared

Jun 7, 2026, 14:40 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.