{"id":"CVE-2017-8659","aliases":["EUVD-2022-4086","GHSA-h6m7-jphx-f9p5"],"status":"published","title":"ChakraCore information disclosure vulnerability","description":"Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to the Chakra scripting engine not properly handling objects in memory, aka \"Scripting Engine Information Disclosure Vulnerability\".","severity":{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.06002,"percentile":0.93371,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200"],"published":"2017-08-08T21:00:00Z","modified":"2026-06-17T01:26:44Z","fixes":[{"ecosystem":"NuGet","package":"Microsoft.ChakraCore","fixed_in":["1.6.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"NuGet","package":"Microsoft.ChakraCore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1"}]}]},{"source":"osv","ecosystem":"NuGet","package":"Microsoft.ChakraCore","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.6.1"}]}],"versions":["1.2.0","1.2.1","1.2.2","1.2.3","1.2.6.62716-preview","1.3.0","1.3.1","1.3.2","1.4.0","1.4.1","1.4.2","1.4.3","1.4.4","1.4.5","1.5.0","1.5.1","1.5.2","1.5.3","1.6.0"]}],"products":[{"vendor":"microsoft","product":"edge"},{"vendor":"microsoft corporation","product":"microsoft scripting engine"}],"references":[{"url":"https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8659","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","web"]},{"url":"http://www.securityfocus.com/bid/100029","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"http://www.securitytracker.com/id/1039095","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2017-8659","tags":["advisory"]},{"url":"https://github.com/chakra-core/ChakraCore/pull/3509","tags":["web"]},{"url":"https://github.com/chakra-core/ChakraCore/commit/2500e1cdc12cb35af73d5c8c9b85656aba6bab4d","tags":["web"]},{"url":"https://web.archive.org/web/20210612224703/http://www.securityfocus.com/bid/100029","tags":["web"]},{"url":"https://web.archive.org/web/20211127144809/http://www.securitytracker.com/id/1039095","tags":["web"]},{"url":"https://github.com/advisories/GHSA-h6m7-jphx-f9p5"},{"url":"https://github.com/chakra-core/ChakraCore","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2017-8659","description":"Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to the Chakra scripting engine not properly handling objects in memory, aka \"Scripting Engine Information Disclosure Vulnerability\".","status":"published","published":"2017-08-08T21:00:00Z","modified":"2024-09-16T22:55:50.158Z","updated_at":"2026-11-02T14:33:15.201133Z"}],"euvd":[{"id":"EUVD-2022-4086","description":"Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to the Chakra scripting engine not properly handling objects in memory, aka \"Scripting Engine Information Disclosure Vulnerability\".","status":"published","published":"2017-08-08T21:00:00Z","modified":"2024-09-16T22:55:50Z","updated_at":"2026-11-03T00:54:58.800859Z"}],"ghsa":[{"id":"GHSA-h6m7-jphx-f9p5","title":"ChakraCore information disclosure vulnerability","description":"Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to the Chakra scripting engine not properly handling objects in memory, aka \"Scripting Engine Information Disclosure Vulnerability\".","status":"published","published":"2022-05-17T02:13:52Z","modified":"2023-10-24T12:57:08Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:37:09.438703Z"}],"nvd":[{"id":"CVE-2017-8659","description":"Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to the Chakra scripting engine not properly handling objects in memory, aka \"Scripting Engine Information Disclosure Vulnerability\".","status":"published","published":"2017-08-08T21:29:01.61Z","modified":"2026-06-17T01:26:44.813Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:57.282351Z"}],"osv":[{"id":"GHSA-h6m7-jphx-f9p5","title":"ChakraCore information disclosure vulnerability","description":"Microsoft Edge in Microsoft Windows 10 1703 allows an attacker to obtain information to further compromise the user's system due to the Chakra scripting engine not properly handling objects in memory, aka \"Scripting Engine Information Disclosure Vulnerability\".","status":"published","published":"2022-05-17T02:13:52Z","modified":"2024-02-16T08:19:20.066339Z","cvss":[{"version":"3.0","score":4.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","level":"medium"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:48.546324Z"}]}}