CVE-2018-11418: Critical – An issue was discovered in JerryScript 1.0. There is a heap-based

CWE Weakness Definitions

CWE-125: Out-of-Bounds Read

Software reads data past the boundary of an allocated buffer, leaking sensitive information or causing crashes.

Related Attack Patterns (CAPEC)

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

This vulnerability was disclosed in 2018. A critical vulnerability affects Jerryscript systems (CVE-2018-11418). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

BSID: BS-2018-GLOBAL-123893-C • Model: rule-based-v1 • Confidence: MEDIUM

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →

Frequently Asked Questions

What is CVE-2018-11418?

This vulnerability was disclosed in 2018. A critical vulnerability affects Jerryscript systems (CVE-2018-11418). No public exploit code is currently available. Isolate affected systems if patching is not feasible.

What is the CVSS score for CVE-2018-11418?

CVE-2018-11418 has CVSS 9.8 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 1.6%.

Is CVE-2018-11418 actively exploited?

No confirmed active exploitation of CVE-2018-11418 as of 2026-05-30.

How do I remediate CVE-2018-11418?

Priority: MEDIUM.

What systems are affected by CVE-2018-11418?

CVE-2018-11418 affects Jerryscript Jerryscript.

Vulnerability Details

CVE ID	`CVE-2018-11418`
BSID	`BS-2018-GLOBAL-123893-C` BreachSpider Global ID
CVSS Vector	`CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`
Published	2018-05-24
Last Modified	2024-11-21
ICS Relevance	15%
Weakness (CWE)	Out-of-Bounds Read
Source	NVD

Official Description

An issue was discovered in JerryScript 1.0. There is a heap-based buffer over-read in the lit_read_code_unit_from_utf8 function via a RegExp("[\\u0020") payload, related to re_parse_char_class in parser/regexp/re-parser.c.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

Vulnerability details: An issue was discovered in JerryScript 1.0. There is a heap-based buffer over-read in the lit_read_code_unit_from_utf8 function via a RegExp("[\\u0020") payload, related to re_parse_char_class in parser/regexp/re-parser.c. CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Exploitation Likelihood: LOW

Affected Products

Vendor	Product	Affected Versions
Jerryscript	Jerryscript	`1.0`

Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence

● Threat Intelligence Validated: October 2026 | Threat Age: 3066 Days

CISA known-exploited	Not in KEV catalog
Public Exploit	Not confirmed
PoC Code	Not confirmed

AI Enrichment Record — provenance & audit hash

Model	`rule-based-v1`
Confidence	MEDIUM
Enriched At	2026-05-24
SHA-512 Audit Hash	`a91a2c5687fb309c6eb00bdb3822678926ac03873ef2469b2a81a5c6a6004741ee5621310075a97664ea098d4ddddd3999884f9adee45777fd31696bc63d0f54`

Related CVEs affecting Jerryscript

CVE-2020-23302 9.8 There is a heap-use-after-free at ecma-helpers-string.c:772 in ecma_ref_ecma_... CVE-2017-18212 9.8 An issue was discovered in JerryScript 1.0. There is a heap-based buffer over... CVE-2018-11419 9.8 An issue was discovered in JerryScript 1.0. There is a heap-based buffer over... CVE-2019-1010176 9.8 JerryScript commit 4e58ccf68070671e1fff5cd6673f0c1d5b80b166 is affected by: B... CVE-2020-23303 9.8 There is a heap-buffer-overflow at jmem-poolman.c:165 in jmem_pools_collect_e...

View all Jerryscript CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →