Security readout for executives and security teams
Plain-English summary
Hermes had a memory-safety flaw that could let crafted JavaScript potentially run code. The key business qualifier is exposure: sources state it is only exploitable when an application using Hermes permits untrusted JavaScript evaluation, and most React Native applications are not affected.
Executive priority
Handle as a focused exposure review. It is not presented as broadly exploitable across React Native, but affected Hermes deployments that evaluate untrusted JavaScript should be updated or constrained because the potential impact is code execution.
Technical view
CVE-2021-24037 is a CWE-416 use-after-free in Facebook Hermes while emitting certain error messages before commit d86e185e485b6330216dee8e854455c694e3a36e. The reported impact is potential arbitrary code execution through crafted JavaScript, constrained to applications that evaluate untrusted JavaScript.
Likely exposure
Likely limited to applications embedding Hermes and allowing untrusted JavaScript evaluation. Standard React Native applications are stated as mostly unaffected, but custom scripting, plugins, or user-supplied JavaScript features should be checked.
Exploitation context
The source bundle does not show CISA KEV listing, public exploitation, or exploit availability. Exploitation should not be assumed unless an exposed application accepts and evaluates untrusted JavaScript with a vulnerable Hermes build.
Researcher notes
Evidence is concise: affected scope is Hermes before one commit, weakness is CWE-416, and exploitability depends on untrusted JavaScript evaluation. No CVSS vector, proof-of-concept status, or active exploitation evidence is provided in the bundle.
Mitigation direction
- Update Hermes to include commit d86e185e485b6330216dee8e854455c694e3a36e or later.
- Disable or restrict evaluation of untrusted JavaScript in Hermes-backed applications.
- Review Facebook and Hermes guidance for any version-specific remediation details.
- Prioritize apps with scripting, plugin, template, or user-supplied JavaScript features.
Validation and detection
- Inventory applications and builds that include Facebook Hermes.
- Confirm the Hermes source or dependency includes commit d86e185e485b6330216dee8e854455c694e3a36e or later.
- Review application features for untrusted JavaScript evaluation paths.
- Document whether each React Native application uses Hermes and accepts untrusted JavaScript.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-416: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupExecution behavior lookup
The CVE wording references code or command execution, so execution technique review may help defensive triage. This is a Glexia inferred lookup path, not an official MITRE, ATT&CK, or CVE Program mapping.
Open ATT&CK lookupCVE-2021-24037 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/facebook/hermes/commit/d86e185e485b6330216dee8e854455c694e3a36eCVE reference · x_refsource_CONFIRM
- https://www.facebook.com/security/advisories/CVE-2021-24037CVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.