Cyber Resilience

CVE-2023-24832

High

Published: 18 May 2023

Published
18 May 2023
Modified
21 January 2025
KEV Added
—
Patch
—
CVSS Score v3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0047 65.0th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-24832 is a high-severity NULL Pointer Dereference (CWE-476) vulnerability in Facebook Hermes. Its CVSS base score is 7.5 (High).

Operationally, ranked in the top 35.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability details

A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. Note that this is only exploitable in cases…

more

where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.

CWE(s)
CWE-476

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

facebook
hermes
≤ 2023-01-31

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References