Cyber Resilience

CVE-2023-23557

Critical

Published: 18 May 2023

Published
18 May 2023
Modified
21 January 2025
KEV Added
—
Patch
—
CVSS Score v3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0076 73.7th percentile
Risk Priority 20 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-23557 is a critical-severity Type Confusion (CWE-843) vulnerability in Facebook Hermes. Its CVSS base score is 9.8 (Critical).

Operationally, ranked in the top 26.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a malicious attacker to execute arbitrary code via type confusion. Note that this is only exploitable in cases where Hermes is used to…

more

execute untrusted JavaScript. Hence, most React Native applications are not affected.

CWE(s)
CWE-843

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

facebook
hermes
≤ 2023-01-10

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References