CVE-2022-35289 Integer overflow in Hermes

Critical 9.8 Published 11 Oct 2022 Updated 3 Aug 2024

An integer overflow in the Hermes JavaScript engine allows arbitrary code execution if the application evaluates untrusted JavaScript.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2022-35289?

CVE-2022-35289 is a critical vulnerability in Facebook Hermes, published on 11 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

A write-what-where condition in hermes caused by an integer overflow, prior to commit 5b6255ae049fa4641791e47fad994e8e8c4da374 allows attackers to potentially execute arbitrary code via crafted JavaScript. Note that this is only exploitable if the application using Hermes permits evaluation of untrusted JavaScript. Hence, most React Native applications are not affected.

Weakness: CWE-190, CWE-680

Which versions are affected by CVE-2022-35289?

It affects 1 product.

Products include Facebook Hermes.

How do I fix CVE-2022-35289?

No fix has been published for CVE-2022-35289 yet. Limit exposure of the affected software until one is available.

Is CVE-2022-35289 being exploited?

There is no known exploitation of CVE-2022-35289 in the wild and no public exploit code.

Sources

Also known as GHSA-mc36-3fhx-66vv.