Error in BigInt Conversion in Hermes Engine by Facebook
CVE-2023-23556

9.8CRITICAL

Key Information:

Vendor

Facebook

Status
Hermes
Vendor
CVE Published:
18 May 2023

What is CVE-2023-23556?

A flaw in the Hermes JavaScript engine allows for improper handling of BigInt conversions to Number. This vulnerability can potentially permit a malicious actor to execute arbitrary code through out-of-bounds write conditions. It is important to note that this issue primarily impacts applications using untrusted JavaScript in the Hermes environment, thus limiting its risk to most React Native applications.

Affected Version(s)

Hermes 0

References

https://www.facebook.com/security/advisories/cve-2023-23556
x_refsource_CONFIRM
https://github.com/facebook/hermes/commit/a6dcafe6ded8e61...
x_refsource_MISC

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2023-23556 : Error in BigInt Conversion in Hermes Engine by Facebook