CVE-2018-8319

highpriority · track · 42EPSS 0.077 · 95 %ileEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

7.72% (95th) EPSS

CVSS 7.5 · high

Is it mine?

3 products

Check your exposure

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · scored 2026-10-26

A Security Feature Bypass vulnerability exists in MSR JavaScript Cryptography Library that is caused by incorrect arithmetic computations, aka "MSR JavaScript Cryptography Library Security Feature Bypass Vulnerability." This affects Microsoft Research JavaScript Cryptography Library.

cvss

Technical severity, 0–10. One row per scoring source.

9.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 10 · impact 6.4

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 3.9 · impact 5.9

v3.09.8criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.09criticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-682USprimaryCWE-682US

affected products (3)

Products and version ranges known to be affected.

Microsoft Microsoft Research JavaScript Cryptography Library≤ Microsoft Research JavaScript Cryptography Libraryenisa_euvdEU
microsoft research javascript cryptography library= 1.4nvdUScpe:2.3:a:microsoft:research_javascript_cryptography_library:*:*:*:*:*:*:*:*
npm msrcrypto< 1.4.1osvUSpkg:npm/msrcrypto

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-qg3g-2mgh-33j8Sensitive Data Exposure in msrcrypto2018-09-10ghsa · osvUS
Versions of `msrcrypto` prior to 1.4.1 are vulnerable to Sensitive Data Exposure. The package's Elliptic Curve Cryptography (ECC) implementation may leak information about a server's private ECC key. It can also allow attackers to craft invalid ECDSA signatures that pass as valid. There is no published proof-of-concept for this vulnerability. ## Recommendation Upgrade to version 1.4.1 or later.

also known as (3)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

published 2018-07-11modified 2026-06-17

related (254)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2022-30780US	high7.5	57.2% (99th)	Exploit	2022-06-11
Lighttpd 1.4.56 through 1.4.58 allows a remote attacker to cause a denial of service (CPU consumption from stuck connections) because connection_read_header_more in connections.c h…
CVE-2016-0777US	medium6.5	63.5% (99th)	Exploit	2016-01-14
The resend_bytes function in roaming_common.c in the client in OpenSSH 5.x, 6.x, and 7.x before 7.1p2 allows remote servers to obtain sensitive information from process memory by r…
CVE-2017-7376US	critical9.8	23.0% (98th)	Exploit	2018-02-19
Buffer overflow in libxml2 allows remote attackers to execute arbitrary code by leveraging an incorrect limit for port values when handling redirects.
CVE-2022-30600US	critical9.8	4.97% (92nd)	Exploit	2022-05-18
A flaw was found in moodle where logic used to count failed login attempts could result in the account lockout threshold being bypassed.
CVE-2021-45960US	high8.8	4.67% (92nd)	Exploit	2022-01-01
In Expat (aka libexpat) before 2.4.3, a left shift by 29 (or more) places in the storeAtts function in xmlparse.c can lead to realloc misbehavior (e.g., allocating too few bytes, o…

+249 more

references (7)

External citations — patches, advisories, analysis.

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8319 cnnvd
http://www.securityfocus.com/bid/104655 enisa_euvd
http://www.securitytracker.com/id/1041268 enisa_euvd
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8319 enisa_euvd
http://www.securityfocus.com/bid/104655Third Party AdvisoryVDB Entrynvd
http://www.securitytracker.com/id/1041268Third Party AdvisoryVDB Entrynvd
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8319PatchVendor Advisorynvd

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan