CVE-2017-11914: ChakraCore Privilege Escalation
Summary
CVE-2017-11914: ChakraCore vulnerable to privilege escalation due to exposure from scriptFunction. Affects Microsoft.ChakraCore versions < 1.7.5. Fixed in 1.7.5. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ChakraCore is a JavaScript engine developed by Microsoft and used in Microsoft Edge and Windows operating systems. It provides the runtime environment for executing JavaScript code. This vulnerability affects ChakraCore in Windows 10 versions 1511, 1607, 1703, 1709, and Windows Server 2016. The vulnerability allows an attacker to gain the same user rights as the current user by exploiting how the scripting engine handles objects in memory. This can lead to privilege escalation and potential unauthorized access to sensitive information.
Vulnerability Detail
The scripting engine in ChakraCore and Microsoft Edge has a memory corruption vulnerability that can be exploited by an attacker. By manipulating objects in memory, an attacker can gain elevated privileges and execute arbitrary code with the same rights as the current user. This vulnerability has a CVSS score of 7.5, indicating a high severity level. It is important to note that this CVE ID is unique from other related vulnerabilities.
How To Fix
Latest published version: 1.11.24 as of 22 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.7.5
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is crucial to apply the recommended fix by updating the affected package and related software components.
Conclusion
The ChakraCore Privilege Escalation vulnerability in Windows 10 and Windows Server 2016 can lead to unauthorized access and potential system compromise. It is crucial to update the affected package and related software components to mitigate this vulnerability. Regularly applying security updates is essential to ensure the overall security of the system.
See every vulnerability recorded for Microsoft.ChakraCore →
FAQ
ChakraCore is a JavaScript engine developed by Microsoft. It is used in Microsoft Edge and Windows operating systems to execute JavaScript code.
Windows 10 versions 1511, 1607, 1703, 1709, and Windows Server 2016 are affected by this vulnerability.
This vulnerability allows an attacker to gain elevated privileges and execute arbitrary code with the same rights as the current user. It can lead to unauthorized access to sensitive information and potential system compromise.
Yes, updating the affected package to version 1.7.5 or later will fix this vulnerability. It is also important to keep the Windows operating system and Microsoft Edge browser up to date with the latest security updates.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for Microsoft.ChakraCore.
