CVE-2023-24832

Name of the Vulnerable Software and Affected Versions Hermes versions prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708

Description A null pointer dereference bug could have been used by an attacker to crash an Hermes runtime where the EnableHermesInternal config option was set to true. This is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Most React Native applications are not affected.

Recommendations For Hermes versions prior to commit 5cae9f72975cf0e5a62b27fdd8b01f103e198708, consider updating to a version that includes the fix for this issue. As a temporary workaround, consider setting the EnableHermesInternal config option to false to prevent exploitation. Restrict the execution of untrusted JavaScript in Hermes to minimize the risk of crashing the runtime.