CVE-2019-0649: Chakra JIT server Privilege Escalation
8.1
CVSS Score
3.0
Basic Information
CVE ID
GHSA ID
EPSS Score
0.89722%
CWE
-
Published
5/13/2022
Updated
9/28/2023
KEV Status
No
Technology
C#
C#Technical Details
CVSS Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| Microsoft.ChakraCore | nuget | < 1.11.6 | 1.11.6 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The commit diff shows both functions replaced Assert with AssertOrFailFast to validate 'profiledCallSiteId' against GetProfiledCallSiteCount(). The original Assert statements (which are debug-only checks) allowed out-of-bounds access in release builds, enabling memory corruption. The vulnerability title explicitly mentions 'construct Caches array out-of-bounds', directly implicating these cache management functions.