Every CVE Search/ Get API key

CVE-2017-11767

ChakraCore vulnerable to privilege escalation

9.8 CriticalFix available

ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

9.51%Up 2.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 9.8

ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".

Record
CVE-2017-11767
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
10.0 HighAV:N/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-119
Updated
2026-11-02
CVE List No score

ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".

Record
CVE-2017-11767
Updated
2026-11-02
EUVDEUVD-2022-3526 No score

ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engine Memory Corruption Vulnerability".

Record
EUVD-2022-3526
Updated
2026-11-03
GitHub AdvisoriesGHSA-c79v-2rjq-965m 9.8

ChakraCore vulnerable to privilege escalation

ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Record
GHSA-c79v-2rjq-965m
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02
OSVGHSA-c79v-2rjq-965m 9.8

ChakraCore vulnerable to privilege escalation

ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory. If the current user is logged on with administrative user rights, an attacker who successfully exploited the vulnerability could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Record
GHSA-c79v-2rjq-965m
CVSS 3.0
9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-119
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
Microsoft.ChakraCore
NuGet
before 1.6.2
1.6.2
Microsoft.ChakraCore
NuGet
before 1.6.2, plus listed versions
1.2.01.2.11.2.21.2.31.2.6.62716-preview
Show 14 moreShow less
1.3.01.3.11.3.21.4.01.4.11.4.21.4.31.4.41.4.51.5.01.5.11.5.21.5.31.6.0
1.6.2

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2017-11767 is a critical vulnerability (CVSS 9.8) in Microsoft Chakracore, published November 2, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 9.51%, the 95th percentile. Fixed in Microsoft.ChakraCore 1.6.2.

References

Show 6 moreShow less
MoveEnter Open