CVE-2024-27094CWE-125

OpenZeppelin Contracts base64 encoding may read from potentially dirty memory

Medium · published February 29, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
54.9
In the wild
Unconfirmed
What it is

OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00763 · 54.9th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2024-02-29T18:18Z
EPSS history
Timeline
  • 29 FEB 18:18Z
    OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
    cvelistv5