-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems from improper vtable validation in array type checking. The patch replaces GetArrayForArrayOrObjectWithArray with Jit_GetArrayForArrayOrObjectWithArray, adding CrossSite vtable checks and explicit array type validation. The original function's failure to handle CrossSite-wrapped vtables allowed attackers to bypass array head segment validation, leading to out-of-bounds writes as demonstrated in the PoC where array length manipulation caused memory corruption.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.ChakraCore | nuget | < 1.11.1 | 1.11.1 |