OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
Priority LOW 34CWE-125Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00763 55th percentileScored 2026-11-07
Fix Fixed openzeppelin-contracts (OpenZeppelin): 4.9.6, 5.0.2@openzeppelin/contracts (npm): 4.9.6, 5.0.2+1 more product
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| OpenZeppelin | openzeppelin-contracts | 4.5.0 to before 4.9.6; 5.0.0-rc.0 to before 5.0.2 | 4.9.6, 5.0.2 | Patch available | CNA |
| — | @openzeppelin/contracts (npm) | 4.5.0 to before 4.9.6 | 4.9.6 | Patch available | GHSA-9vx6-7xxf-x967 |
| — | @openzeppelin/contracts-upgradeable (npm) | 5.0.0-rc.0 to before 5.0.2 | 5.0.2 | Patch available | GHSA-9vx6-7xxf-x967 |
| — | @openzeppelin/contracts (npm) | 5.0.0-rc.0 to before 5.0.2 | 5.0.2 | Patch available | GHSA-9vx6-7xxf-x967 |
| — | @openzeppelin/contracts-upgradeable (npm) | 4.5.0 to before 4.9.6 | 4.9.6 | Patch available | GHSA-9vx6-7xxf-x967 |
- openzeppelin-contracts VendorOpenZeppelin Affected 4.5.0 to before 4.9.6; 5.0.0-rc.0 to before 5.0.2 Fixed in 4.9.6, 5.0.2 Patch available CNA
- @openzeppelin/contracts (npm) Vendor— Affected 4.5.0 to before 4.9.6 Fixed in 4.9.6 Patch available GHSA-9vx6-7xxf-x967
- @openzeppelin/contracts-upgradeable (npm) Vendor— Affected 5.0.0-rc.0 to before 5.0.2 Fixed in 5.0.2 Patch available GHSA-9vx6-7xxf-x967
- @openzeppelin/contracts (npm) Vendor— Affected 5.0.0-rc.0 to before 5.0.2 Fixed in 5.0.2 Patch available GHSA-9vx6-7xxf-x967
- @openzeppelin/contracts-upgradeable (npm) Vendor— Affected 4.5.0 to before 4.9.6 Fixed in 4.9.6 Patch available GHSA-9vx6-7xxf-x967
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:* | 4.5.0 to before 4.9.6; 5.0.0 to before 5.0.2 | Vulnerable | OpenZeppelin |
| cpe:2.3:a:openzeppelin:contracts_upgradeable:*:*:*:*:*:node.js:*:* | 4.5.0 – 4.9.6; 5.0.0 to before 5.0.2 | Vulnerable | OpenZeppelin |
- cpe:2.3:a:openzeppelin:contracts:*:*:*:*:*:node.js:*:* Versions 4.5.0 to before 4.9.6; 5.0.0 to before 5.0.2 Vulnerable ·OpenZeppelin
- cpe:2.3:a:openzeppelin:contracts_upgradeable:*:*:*:*:*:node.js:*:* Versions 4.5.0 – 4.9.6; 5.0.0 to before 5.0.2 Vulnerable ·OpenZeppelin
Remediation
- Fix · CNA openzeppelin-contracts (OpenZeppelin) Fixed in 4.9.6, 5.0.2
- Fix · GHSA-9vx6-7xxf-x967 @openzeppelin/contracts (npm) Fixed in 4.9.6 Advisory →
- Fix · GHSA-9vx6-7xxf-x967 @openzeppelin/contracts-upgradeable (npm) Fixed in 5.0.2 Advisory →
- Fix · GHSA-9vx6-7xxf-x967 @openzeppelin/contracts (npm) Fixed in 5.0.2 Advisory →
- Fix · GHSA-9vx6-7xxf-x967 @openzeppelin/contracts-upgradeable (npm) Fixed in 4.9.6 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-27094
- 2026-10-03 Alias added: GHSA-9vx6-7xxf-x967
References
Patch 4
- https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/2d081f24cac1a867f6f73d512f2022e1fa987854
- https://github.com/OpenZeppelin/openzeppelin-contracts-upgradeable/commit/723f8cab09cdae1aca9ec9cc1cfa040c2d4b06c1
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/92224533b1263772b0774eec3134e132a3d7b2a6
- https://github.com/OpenZeppelin/openzeppelin-contracts/commit/a6286d0fded8771b3a645e5813e51993c490399c
Advisory 2
More OpenZeppelin Contracts vulnerabilities
- TI-2022-13196 OpenZeppelin Contracts for Cairo account cannot process transactions on Goerli CVSS 3.1MEDIUM 6.5
- TI-2021-16554 TimelockController vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 10.0
- TI-2021-16553 TimelockController vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 10.0
- TI-2021-18096 UUPSUpgradeable vulnerability in OpenZeppelin Contracts CVSS 3.1CRITICAL 9.8
- TI-2022-13238 GovernorVotesQuorumFraction updates to quorum may affect past defeated proposals in @openzeppelin/contracts CVSS 3.1HIGH 7.5
- TI-2022-13212 OpenZeppelin Contracts's ERC165Checker may revert instead of returning false CVSS 3.1HIGH 7.5
Sources
- CVE-2024-27094 · CVE Program
- CVE-2024-27094 · NVD
- FIRST EPSS
- GHSA-9vx6-7xxf-x967 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences