CVE-2024-5436: Critical Type Confusion in Snapchat LensCore

CVE-2024-5436 is a Critical (CVSS 9.8) type confusion flaw in Snapchat LensCore, the component behind Lenses. The record says it could lead to denial of service or arbitrary code execution before version 12.88, and recommends upgrading to 12.88 or above.

What's affected

• Product: Snapchat LensCore, per the record's CPE entry.
• Affected versions: all versions before 12.88.
• Fixed version: 12.88 or above, as stated in the record. The HackerOne page linked from the record needs JavaScript and would not render for me, so I could not read the original report. Nothing below goes beyond the record.
• Severity: Critical, CVSS 9.8. The vector is network based, needs no privileges and no user interaction, with high impact on confidentiality, integrity and availability.
• Exploitation: the record's KEV flag is false. I found no source that reports exploitation.

How to check if you're exposed

For individuals, open the Snapchat app, go to settings, and read the version number at the bottom. Check the app store page too, which shows whether an update is waiting.

For a company, the question is whether managed devices carry the app. Your mobile device management console can list installed apps and versions on iOS and Android fleets. Filter for Snapchat and sort by version.

The record gives no specifics about which platforms are affected, so do not assume that one operating system is safe. Update everywhere.

What to do now

1. Update Snapchat to version 12.88 or later through the official app store on every device.
2. Turn on automatic updates for the app where policy allows.
3. If you manage devices, report on app versions and push an update prompt to those below 12.88.
4. If your company uses Snapchat for marketing or social accounts on shared phones, include those devices in the sweep.
5. Keep the operating system patched as well. App level flaws are often easier to reach on devices that lack OS protections.

Why it matters

The record maps this to CWE-843, access of a resource using an incompatible type, and CWE-704, incorrect type conversion or cast. The program treats a piece of memory as one type of object when it is really another. Code that then reads or writes it can touch memory it should not, which is why this class often becomes a crash at best and code execution at worst.

The record does not explain the delivery path, so I will not guess at one. The score assumes no privileges and no user interaction. The vendor did the practical thing by shipping a fixed build and asking users to upgrade. For consumer apps, the real risk is the long tail of people who never update, so ask the people who run your team accounts to check.

Quick check

Sources

• NVD record data for CVE-2024-5436, as supplied in the batch record
• Snapchat HackerOne program page linked from the record (did not render without JavaScript, so its contents are not used here)

Last reviewed: 19 October 2026.