-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.ChakraCore | nuget | < 1.8.5 | 1.8.5 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of operand types during JIT optimization. The patch modifies OptHoistUpdateValueType to accept a pointer-to-pointer (IR::Opnd**), allowing it to update the caller's operand reference after type conversion. The original implementation passed IR::Opnd* directly, causing stale pointers and type confusion when Conv_PrimStr replaced the operand. OptHoistInvariant's calls to OptHoistUpdateValueType with raw pointers (instead of addresses) exacerbated this issue. The exploit demonstrates how hoisted SetConcatStrMultiItemBE instructions retained incorrect type assumptions, leading to memory corruption.