CVE-2023-24832

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A null pointer dereference bug in Hermes prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708 could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

No affected versions have been published.

Timeline

Published
May 18, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-248337.5A use-after-free in BigIntPrimitive addition in Hermes prior to commit a6dcafe6ded8e61658b40f5699878cd19a481f80 could have been used by an aCVE-2023-248346.5WisdomGarden Tronclass has improper access control when uploading file. An authenticated remote attacker with general user privilege can expCVE-2023-248357.2Softnext Technologies Corp.’s SPAM SQR has a vulnerability of Code Injection within its specific function. An authenticated remote attacker CVE-2023-248368.8SUNNET CTMS has vulnerability of path traversal within its file uploading function. An authenticated remote attacker with general user priviCVE-2023-248378.8HGiga PowerStation remote management function has insufficient filtering for user input. An authenticated remote attacker with general user CVE-2023-248389.8HGiga PowerStation has a vulnerability of Information Leakage. An unauthenticated remote attacker can exploit this vulnerability to obtain tCVE-2023-248396.1HGiga MailSherlock’s specific function has insufficient filtering for user input. An unauthenticated remote attacker can exploit this vulnerCVE-2023-24844.9The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versCVE-2023-248407.2HGiga MailSherlock mail query function has vulnerability of insufficient validation for user input. An authenticated remote attacker with adCVE-2023-248417.2HGiga MailSherlock query function for connection log has a vulnerability of insufficient filtering for user input. An authenticated remote aCVE-2023-248425.3HGiga MailSherlock has vulnerability of insufficient access control. An unauthenticated remote user can exploit this vulnerability to accessCVE-2023-248437.5Transient DOS in Modem while triggering a camping on an 5G cell.
CVE-2023-24832: High severity, CVSS 7.5 | Vulnix