What is CVE-2023-30470?

CVE-2023-30470 is a critical-severity vulnerability in Facebook Hermes, classified under Use After Free. CVSS score: 9.8/10. Published 2023-05-18.

How severe is CVE-2023-30470?

Critical severity. CVSS v3 base score is 9.8 out of 10.

Use After Free in Facebook Hermes

CVE-2023-30470

A use-after-free related to unsound inference in the bytecode generation when optimizations are enabled for Hermes prior to commit da8990f737ebb9d9810633502f65ed462b819c09 could have been used by an attacker to achieve remote code executio…

Vulnerability class: Use-After-Free

EPSS: 0.012 (66.1th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Facebook Hermes — versions 0

Weakness classification (CWE)

CWE-416 — Use After Free

References

cve-assign@fb.com (x_refsource_CONFIRM, Patch, Vendor Advisory)
cve-assign@fb.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2023-30470?: CVE-2023-30470 is a critical-severity vulnerability in Facebook Hermes, classified under Use After Free. CVSS score: 9.8/10. Published 2023-05-18.
How severe is CVE-2023-30470?: Critical severity. CVSS v3 base score is 9.8 out of 10.