CVE-2022-32234

Published: Oct 11, 2022Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

An out of bounds write in hermes, while handling large arrays, prior to commit 06eaec767e376bfdb883d912cb15e987ddf2bda1 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

Affected (1)

Products: Facebook: Hermes

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Facebook Hermes	Before 0.12.0

Related CWEs

Out-of-bounds Write

The product writes data past the end, or before the beginning, of the intended buffer.

References (4)

https://github.com/facebook/hermes/commit/06eaec767e376bfdb883d912cb15e987ddf2bda1

Source: cve-assign@fb.com

PatchThird Party Advisory

https://www.facebook.com/security/advisories/CVE-2022-32234

Source: cve-assign@fb.com

Vendor Advisory

https://github.com/facebook/hermes/commit/06eaec767e376bfdb883d912cb15e987ddf2bda1

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://www.facebook.com/security/advisories/CVE-2022-32234

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

Timeline

No history available yet.