CVE-2023-23556

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An error in BigInt conversion to Number in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by a malicious attacker to execute arbitrary code due to an out-of-bound write. Note that this bug is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-787

Affected software

Vendor	Product	Versions
Facebook	Hermes	< a6dcafe6ded8e61658b40f5699878cd19a481f80

References

https://github.com/facebook/hermes/commit/a6dcafe6ded8e61658b40f5699878cd19a481f80Patch
https://www.facebook.com/security/advisories/cve-2023-23556Patch, Vendor Advisory
https://github.com/facebook/hermes/commit/a6dcafe6ded8e61658b40f5699878cd19a481f80Patch
https://www.facebook.com/security/advisories/cve-2023-23556Patch, Vendor Advisory

Timeline

Published: May 18, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-235579.8An error in Hermes' algorithm for copying objects properties prior to commit a00d237346894c6067a594983be6634f4168c9ad could be used by a mal CVE-2023-235586.3In Eternal Terminal 6.2.1, TelemetryService uses fixed paths in /tmp. For example, a local attacker can create /tmp/.sentry-native-etserver CVE-2023-235597.8In rndis_query_oid in drivers/net/wireless/rndis_wlan.c in the Linux kernel through 6.1.5, there is an integer overflow in an addition.CVE-2023-23567.5Relative Path Traversal in GitHub repository mlflow/mlflow prior to 2.3.1.CVE-2023-235609.8In certain Lexmark products through 2023-01-12, SSRF can occur because of a lack of input validation.CVE-2023-235615.5Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control: authenticated users can read sensitive information.CVE-2023-235624.3Stormshield Endpoint Security 2.3.0 through 2.3.2 has Incorrect Access Control that allows an authenticated user can update global parameter CVE-2023-235636.5An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to obtain sensitive database content via SQL Injec CVE-2023-235648.8An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to execute commands.CVE-2023-235654.9An issue was discovered in Geomatika IsiGeo Web 6.0. It allows remote authenticated users to retrieve PHP files from the server via Local Fi CVE-2023-235669.8A 2-Step Verification problem in Axigen 10.3.3.52 allows an attacker to access a mailbox by bypassing 2-Step Verification when they try to a CVE-2023-235678.8A heap-based buffer overflow vulnerability exists in the CreateDIBfromPict functionality of Accusoft ImageGear 20.1. A specially crafted fil