Skip to main content

Out-of-bounds Read

CVE-2024-27094

Medium
6.5/10

Summary

OpenZeppelin Contracts is a library for secure smart contract development. The 'Base64.encode' function encodes a 'bytes' input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. This issue affects the package @openzeppelin/contracts versions 4.5.0-rc.0 through 4.9.5, and 5.0.0-rc.0 through 5.0.1 and @openzeppelin/contracts-upgradeable versions 4.5.0-rc.0 through 4.9.5, and 5.0.0-rc.0.

  • HIGH
  • NETWORK
  • LOW
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-125 - Out-of-Bounds Read

Out-of-bounds read is a vulnerability that allows access to memory beyond the authorized accessible location. Such a vulnerability compromises the confidentiality of the trusted environment in the application and enables an attacker to launch further attacks by leveraging the exposed information.

References

Advisory Timeline

  • Published