CVE-2022-40138

Katalog CVE

CVSS 9.8 · Critical EPSS 1,2%

Kerentanan Incorrect Conversion between Numeric Types pada facebook hermes. Skor CVSS 3.1 9.8 (Critical) menurut NVD.

Deskripsi (NVD)

An integer conversion error in Hermes bytecode generation, prior to commit 6aa825e480d48127b480b08d13adf70033237097, could have been used to perform Out-Of-Bounds operations and subsequently execute arbitrary code. Note that this is only exploitable in cases where Hermes is used to execute untrusted JavaScript. Hence, most React Native applications are not affected.

Rincian

Terbit di NVD

11 Oktober 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.8 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-681: Incorrect Conversion between Numeric Types

EPSS (30 hari)

1,2% peluang dieksploitasi; lebih tinggi dari 66,9% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://www.facebook.com/security/advisories/CVE-2022-40138 advisory vendor
• https://github.com/facebook/hermes/commit/6aa825e480d48127b480b08d13adf70033237097 patch · advisory pihak ketiga