CVE-2023-24832

Published: May 18, 2023Modified: Jun 17, 2026

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.

Affected (1)

Products: Facebook: Hermes

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Facebook Hermes	Before 2023-01-31

Related CWEs

NULL Pointer Dereference

The product dereferences a pointer that it expects to be valid but is NULL.

References (4)

https://github.com/facebook/hermes/commit/5cae9f72975cf0e5a62b27fdd8b01f103e198708

Source: cve-assign@fb.com

Patch

https://www.facebook.com/security/advisories/cve-2023-24832

Source: cve-assign@fb.com

PatchVendor Advisory

https://github.com/facebook/hermes/commit/5cae9f72975cf0e5a62b27fdd8b01f103e198708

Source: af854a3a-2127-422b-91ae-364da2661108

Patch

https://www.facebook.com/security/advisories/cve-2023-24832

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.