CVE-2020-0829: 
C# vulnerability analysis and mitigation

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, identified as CVE-2020-0829. This vulnerability, also known as 'Scripting Engine Memory Corruption Vulnerability', was disclosed in March 2020 and affects Microsoft Windows systems and the ChakraCore engine (NVD, MITRE).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the following vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. This indicates that the vulnerability is exploitable over the network, requires high attack complexity, needs user interaction, and can result in high impacts to confidentiality, integrity, and availability (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current user. Users with administrative privileges would be more severely impacted compared to users with restricted access (NVD).

The vulnerability requires user interaction and high attack complexity to exploit. It is unique from several other scripting engine vulnerabilities (CVE-2020-0768, CVE-2020-0823, CVE-2020-0825, CVE-2020-0826, CVE-2020-0827, CVE-2020-0828, CVE-2020-0830, CVE-2020-0831, CVE-2020-0832, CVE-2020-0833, CVE-2020-0848) (MITRE).

Microsoft has released security updates to address this vulnerability. The update corrects how the ChakraCore scripting engine handles objects in memory (Microsoft Advisory).