CVE-2024-27094— OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2024-27094
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
Source: NVD (National Vulnerability Database)
Vulnerability Description
OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6.
Source: NVD (National Vulnerability Database)
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Source: NVD (National Vulnerability Database)
Vulnerability Type
跨界内存读
Source: NVD (National Vulnerability Database)
Vulnerability Title
OpenZeppelin 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenZeppelin是一个应用软件。一个安全区块链应用的标准。 OpenZeppelin Contracts 5.0.2之前版本和4.9.6之前版本存在安全漏洞，该漏洞源于当该输入不是3的倍数时，Base64.encode函数最后一次迭代可以读取输入缓冲器之外的存储器部分。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OpenZeppelin | openzeppelin-contracts | >= 4.5.0, < 4.9.6 | - |
II. Public POCs for CVE-2024-27094
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-27094
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same product: openzeppelin-contracts
- CVE-2025-54070
OpenZeppelin Contracts's Bytes's lastIndexOf function with p - CVE-2023-49798
Duplicated execution of subcalls in OpenZeppelin Contracts - CVE-2023-40014
OpenZeppelin Contracts's ERC2771Context with custom forwarde - CVE-2023-34459
OpenZeppelin Contracts's MerkleProof multiproofs may allow p - CVE-2023-34234
Governor proposal creation may be blocked by frontrunning in
Same vendor: OpenZeppelin
- CVE-2025-54070
OpenZeppelin Contracts's Bytes's lastIndexOf function with p - CVE-2024-45304
OwnableTwoStep allows a pending owner to accept ownership af - CVE-2023-49798
Duplicated execution of subcalls in OpenZeppelin Contracts - CVE-2023-40014
OpenZeppelin Contracts's ERC2771Context with custom forwarde - CVE-2023-34459
OpenZeppelin Contracts's MerkleProof multiproofs may allow p
Same weakness: CWE-125
- CVE-2026-8177
XML::LibXML versions through 2.0210 for Perl read out-of-bou - CVE-2026-6104
Global buffer over-read in mb_convert_encoding() with attack - CVE-2026-7258
Out-of-bounds read in urldecode() on NetBSD - CVE-2026-8186
Open5GS NF client.c ogs_sbi_client_send_via_scp_or_sepp out- - CVE-2026-3508
ASUS System Control Interface 缓冲区错误漏洞
V. Comments for CVE-2024-27094
No comments yet