CVE-2021-46338

What it actually does

An assertion failure in ecma_get_lex_env_type at ecma-helpers.c causes the process to abort when processing certain lexical environment objects.

Why it matters to the business

Applications or services using the affected engine can be forced to crash, interrupting availability and requiring restarts.

How an attack unfolds

An attacker crafts input that reaches an invalid lexical environment object; when the engine evaluates it, the assertion triggers and the process terminates. No remote code execution or data access occurs.

How to fix it

Upgrade chakra-core/chakracore and microsoft/chakracore to commit d797e3f00e34c12c8c0ae52f56344325439dccd7 or later; rebuild and redeploy all dependent binaries.

How to confirm the fix worked

Confirm the installed binary or source tree contains commit d797e3f00e34c12c8c0ae52f56344325439dccd7; re-run any available regression tests covering ecma-helpers.c.

Typical attack path

1. Identify a ChakraCore-based application that accepts untrusted scripts or data
2. Prepare a minimal input that violates the lexical environment assumption
3. Deliver the input locally with user interaction (e.g., file open or script load)
4. Trigger evaluation path that calls ecma_get_lex_env_type
5. Observe process termination and service outage

How to detect it

Review application or system logs for abrupt terminations or assertion messages containing ecma_get_lex_env_type or ecma-helpers.c around the time of reported outages.

What your security team should do

• Immediately update all ChakraCore instances to the fixed commit
• Scan build pipelines and package repositories for older snapshots
• Add the fixed commit hash to dependency allow-lists and SBOM checks
• Monitor for any downstream dependents that still ship vulnerable builds