CVE-2018-8389

HIGH EXPLOITED IN THE WILD RANSOMWARE

Internet Explorer <11 - Memory Corruption

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2018-8389 has been observed exploited in the wild (reported by VulnCheck KEV, InTheWild.io), including in ransomware campaigns. EIP tracks 1 public exploit from researchers including sandi-go.

AI-analyzed exploit summary This repository contains a README describing CVE-2018-8389, a use-after-free vulnerability in jscript.dll affecting Internet Explorer. The vulnerability allows remote code execution via memory corruption in the scripting engine.

Description

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-8353, CVE-2018-8355, CVE-2018-8359, CVE-2018-8371, CVE-2018-8372, CVE-2018-8373, CVE-2018-8385, CVE-2018-8390.

Exploits (1)

nomisec WRITEUP
by sandi-go · poc
https://github.com/sandi-go/cve-2018-8389

This repository contains a README describing CVE-2018-8389, a use-after-free vulnerability in jscript.dll affecting Internet Explorer. The vulnerability allows remote code execution via memory corruption in the scripting engine.

Classification
Writeup 90%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Microsoft Internet Explorer (jscript.dll)
No auth needed
Prerequisites: Target must be using a vulnerable version of Internet Explorer · Attacker must deliver a malicious script to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry x_refsource_sectrack
http://www.securitytracker.com/id/1041483
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/105036

Scores

CVSS v3 7.5
EPSS 0.2865
EPSS Percentile 97.9%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

VulnCheck KEV 2020-10-15
InTheWild.io 2022-05-25
Ransomware Use Confirmed
CWE
CWE-787
Status published
Products (3)
microsoft/internet_explorer 11
microsoft/internet_explorer 10
microsoft/internet_explorer 9
Published Aug 15, 2018
Tracked Since Feb 18, 2026