Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2018-8319

35
FAUCET Score

CVE-2018-8319 is a critical Security Feature Bypass vulnerability affecting the Microsoft Research JavaScript Cryptography Library, stemming from incorrect arithmetic computations. With a CVSS score of 9.8, it presents a severe risk, allowing unauthenticated attackers to achieve full compromise of confidentiality, integrity, and availability over a network with low attack complexity. While there is no evidence of active exploitation, public exploit code, or inclusion in CISA's KEV catalog, the vulnerability has garnered significant community discussion and media coverage, indicating awareness and potential for future exploitation.

Impacted Technologies

VendorProductVersion(s)CPE
1.4CPE matchmatch criteria
cpe:2.3:a:microsoft:research_javascript_cryptography_library:1.4:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

9.8CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.0

Exploit Intelligence

EPSS Score
7.03%
Probability of exploitation in next 30 days
EPSS Percentile
93.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-26
Model: v2026.06.15
This CVE's current EPSS score of 0.0703 is in the 89th percentile among its peer group of 36,835 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (3)

microsoftpatch availablevia nvd_reference
View patch
microsoftpatch availablevia msrc
Product: Microsoft Research JavaScript Cryptography Library V1.4
View patch
npmpatch availablevia ghsa
Product: msrcryptoFixed in: 1.4.1

Vendor Advisories (2)

npmGHSA-qg3g-2mgh-33j8critical

Sensitive Data Exposure in msrcrypto

Sep 10, 2018
microsoft2018-Jul/CVE-2018-8319Important

MSR JavaScript Cryptography Library Security Feature Bypass Vulnerability

Jul 10, 2018

References

portal.msrc.microsoft.com / en-US/security-guidance/advisory/CVE-2018-8319
PatchVendor Advisory
securityfocus.com / bid/104655
Third Party AdvisoryVDB Entry
securitytracker.com / id/1041268
Third Party AdvisoryVDB Entry