CVE-2020-1896 Memory corruption in Hermes

Critical 9.8 Published 2 Feb 2021 Updated 4 Aug 2024

A stack overflow in the Hermes JavaScript engine allows arbitrary code execution if the application evaluates untrusted JavaScript.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2020-1896?

CVE-2020-1896 is a critical memory corruption vulnerability in Facebook Hermes, published on 2 Feb 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A stack overflow vulnerability in Facebook Hermes 'builtin apply' prior to commit 86543ac47e59c522976b5632b8bf9a2a4583c7d2 (https://github.com/facebook/hermes/commit/86543ac47e59c522976b5632b8bf9a2a4583c7d2) allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

Weakness: CWE-787, CWE-121

Which versions are affected by CVE-2020-1896?

It affects 1 product.

Products include Facebook Hermes.

How do I fix CVE-2020-1896?

No fix has been published for CVE-2020-1896 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2020-1896 being exploited?

There is no known exploitation of CVE-2020-1896 in the wild and no public exploit code.

Sources

Also known as GHSA-28c6-6wvh-6235.