CVE-2016-3260 in the critical feed json
ChakraCore RCE Vulnerability
published 2016-07-13 10 y ago modified 2026-06-17 4 mo ago also GHSA-h6g3-73h7-chxp , EUVD-2022-4085
- cvss
- 8.8
- version 3.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 23.8%
- EPSS 23.8% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
The Microsoft (1) JScript 9, (2) VBScript, and (3) Chakra JavaScript engines, as used in Microsoft Internet Explorer 11, Microsoft Edge, and other products, allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, aka "Scripting Engine Memory Corruption Vulnerability."
Patch / fix
- nuget Microsoft.ChakraCore 1.2.0.0
- github.com/chakra-core/ChakraCore@17f3d4a commit
- github.com/chakra-core/ChakraCore#1291 pull request
Exploit prediction
23.84% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
| GitHub | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| nuget | Microsoft.ChakraCore | <1.2.0.0 |
1.2.0.0 |
Classification
- Weakness
-
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
-
github.com
/chakra-core/ChakraCore/pull/1291
web
-
github.com
/chakra-core/ChakraCore/commit/17f3d4a4852dcc9e48de7091685b1862afb9f307
web
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2016/ms16-084
vendor-advisory, web
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2016/ms16-085
vendor-advisory, web
-
securitytracker.com
/id/1036283
vdb-entry
-
securityfocus.com
/bid/91580
vdb-entry
-
nvd.nist.gov
/vuln/detail/CVE-2016-3260
advisory
-
github.com
/chakra-core/ChakraCore
package
-
web.archive.org
/web/20210123150650/http://www.securityfocus.com/bid/91580
web
-
web.archive.org
/web/20211202003833/http://www.securitytracker.com/id/1036283
web
Sources
- CVE List CVE-2016-3260
- GitHub Advisory GHSA-h6g3-73h7-chxp
- NVD CVE-2016-3260
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.