PT-2025-29948 · Openzeppelin · Openzeppelin Contracts
Amxx
·
Published
2025-07-17
·
Updated
2025-07-17
·
CVE-2025-54070
CVSS v4.0
6.9
Medium
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
OpenZeppelin Contracts versions 5.2.0 through 5.3.9
Description
The
lastIndexOf(bytes,byte,uint256) function within the Bytes.sol library may access uninitialized memory under specific conditions. This occurs when the provided buffer length is empty (buffer.length == 0) and the position (pos) is not equal to the maximum value for an unsigned 256-bit integer (type(uint256).max). The pos argument could be used to access data outside the intended buffer boundaries, potentially leading to out-of-gas errors or the return of an invalid index. The function reads memory at offset buffer + 0x20 + pos. If the memory at that location matches the search pattern, the function returns an out-of-bounds index instead of the expected maximum value. Code relying on the function returning type(uint256).max for empty buffers or using the returned index without bounds checking may exhibit undefined behavior.Recommendations
OpenZeppelin Contracts versions 5.2.0 through 5.3.9: Upgrade to version 5.4.0.
Exploit
Fix
Out of bounds Read
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Openzeppelin Contracts