CVE-2017-11767
ChakraCore vulnerable to privilege escalation
ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
9.8
ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".
- Record
CVE-2017-11767- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Weakness
- CWE-119
- Updated
- 2026-11-02
CVE List No score
ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".
- Record
CVE-2017-11767- Updated
- 2026-11-02
EUVDEUVD-2022-3526 No score
ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".
- Record
EUVD-2022-3526- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-c79v-2rjq-965m
9.8
ChakraCore vulnerable to privilege escalation
ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Record
GHSA-c79v-2rjq-965m- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
OSVGHSA-c79v-2rjq-965m
9.8
ChakraCore vulnerable to privilege escalation
ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
- Record
GHSA-c79v-2rjq-965m- CVSS 3.0
- 9.8 Critical
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - Weakness
- CWE-119
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
Microsoft.ChakraCoreNuGet |
before 1.6.2 | 1.6.2 |
Microsoft.ChakraCoreNuGet |
before 1.6.2, plus listed versions 1.2.01.2.11.2.21.2.31.2.6.62716-preview Show 14 moreShow less1.3.01.3.11.3.21.4.01.4.11.4.21.4.31.4.41.4.51.5.01.5.11.5.21.5.31.6.0 |
1.6.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-11767 is a critical vulnerability (CVSS 9.8) in Microsoft Chakracore, published November 2, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.51%, the 95th percentile. Fixed in Microsoft.ChakraCore 1.6.2.
References
securitytracker.com/id/1039369
securityfocus.com/bid/100838
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11767
nvd.nist.gov/vuln/detail/CVE-2017-11767
github.com/chakra-core/ChakraCore/pull/3727
github.com/chakra-core/ChakraCore/pull/3727/commits/b3e3959d14814f42ee2197c504c322bcbe12347d
Show 6 moreShow less
web.archive.org/web/20210124103810/http://www.securityfocus.com/bid/100838
web.archive.org/web/20211127230635/http://www.securitytracker.com/id/1039369
github.com/chakra-core/ChakraCore/commit/b3e3959d14814f42ee2197c504c322bcbe12347d
msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-11767
github.com/advisories/GHSA-c79v-2rjq-965m
github.com/chakra-core/ChakraCore