CVE-2022-40138
CVE-2022-40138
In short
Hermes, a JavaScript engine, has a flaw in how it converts numbers when creating bytecode that could allow an attacker to access memory outside intended boundaries and run malicious code if untrusted JavaScript is executed.
Technical detail
An integer conversion vulnerability in Hermes bytecode generation allows out-of-bounds memory access through specially crafted JavaScript. The attack requires execution of untrusted code; exploitation enables arbitrary code execution with the privileges of the Hermes process.
Summary generated and translated by AI from the official description.
An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and subsequently execute arbitrary code. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.
Affected products
Facebook · HermesWant to know if your infrastructure is exposed to this?
Talk to TrueHacking →