What is the CVSS score of CVE-2020-1037?

CVE-2020-1037 has a CVSS 3.1 base score of 4.2 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 7.7%.

Is there a patch available for CVE-2020-1037?

Yes, a patch is available for CVE-2020-1037. Update the affected software to the latest version immediately.

Chakracore CVE-2020-1037

MEDIUM

Out-of-bounds Write (CWE-787)

2020-05-21 secure@microsoft.com

RCE Buffer Overflow Memory Corruption Microsoft Chakracore

4.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.2 MEDIUM

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Severity Changed

Aug 19, 2026 - 17:22 NVD

HIGH MEDIUM

CVSS changed

Aug 19, 2026 - 17:22 NVD

7.5 (HIGH) 4.2 (MEDIUM)

CVE Published

May 21, 2020 - 23:15 nvd

HIGH 7.5

DescriptionNVD

AnalysisAI

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Chakra Scripting Engine Memory Corruption. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.

Technical ContextAI

This vulnerability is classified as Out-of-bounds Write (CWE-787), which allows attackers to write data beyond allocated buffer boundaries leading to code execution or crashes. A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based), aka 'Chakra Scripting Engine Memory Corruption Vulnerability'. Affected products include: Microsoft Edge, Microsoft Chakracore.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Validate write boundaries, use memory-safe languages, enable compiler protections (ASLR, stack canaries).