PT-2024-21645 · Openzeppelin · Openzeppelin Contracts

Rholterhus · Published 2024-02-29 · Updated 2025-12-04 · CVE-2024-27094

Positive Technologies (AI Summary)

CVSS v3.1

7.4

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H

Name of the Vulnerable Software and Affected Versions OpenZeppelin Contracts versions prior to 4.9.6 OpenZeppelin Contracts versions prior to 5.0.2

Description The Base64.encode function in OpenZeppelin Contracts encodes a bytes input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. Although the encode function pads the output for these cases, up to 4 bits of data are kept between the encoding and padding, corrupting the output if these bits were dirty. This issue can occur more frequently in certain scenarios, such as when a bytes memory struct is allocated just after the input and the first bytes of it are non-zero, or when the memory pointer is set to a non-empty memory location before allocating the input. Developers should evaluate whether the extra bits can be maliciously manipulated by an attacker.

Recommendations For versions prior to 4.9.6, upgrade to 4.9.6. For versions prior to 5.0.2, upgrade to 5.0.2. As a temporary workaround, consider restricting the use of the Base64.encode function until a patch is applied.

Exploit

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

CVE-2024-27094

GHSA-9VX6-7XXF-X967

Affected Products

Openzeppelin Contracts

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/27xxx/CVE-2024-27094.json · Exploit
• https://github.com/OpenZeppelin/openzeppelin-contracts/commit/92224533b1263772b0774eec3134e132a3d7b2a6 · Patch
• https://github.com/OpenZeppelin/openzeppelin-contracts/commit/a6286d0fded8771b3a645e5813e51993c490399c · Patch
• https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9vx6-7xxf-x967 · Vendor Advisory
• https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/2d081f24cac1a867f6f73d512f2022e1fa987854 · Patch
• https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/723f8cab09cdae1aca9ec9cc1cfa040c2d4b06c1 · Patch
• https://osv.dev/vulnerability/CVE-2024-27094 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-9vx6-7xxf-x967 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-27094 · Security Note
• https://github.com/OpenZeppelin/openzeppelin-contracts · Note
• https://t.me/cveNotify/144787 · Telegram Post
• https://twitter.com/CVEnew/status/1763272277586493659 · Twitter Post