Description
A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and obtain arbitrary code execution via a carefully crafted payload. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
Published: 2023-05-18
Score: 9.8 Critical
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

No remediation available yet.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
EUVD EUVD EUVD-2023-31806 A bytecode optimization bug in Hermes prior to commit e6ed9c1a4b02dc219de1648f44cd808a56171b81 could be used to cause an use-after-free and obtain arbitrary code execution via a carefully crafted payload. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
History

Tue, 21 Jan 2025 21:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Subscriptions

Facebook Hermes
cve-icon MITRE

Status: PUBLISHED

Assigner: facebook

Published:

Updated: 2025-01-21T20:16:02.965Z

Reserved: 2023-03-10T14:38:22.869Z

Link: CVE-2023-28081

cve-icon Vulnrichment

Updated: 2024-08-02T12:30:23.821Z

cve-icon NVD

Status : Modified

Published: 2023-05-18T22:15:09.807

Modified: 2025-01-21T21:15:09.707

Link: CVE-2023-28081

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses