关键漏洞信息 漏洞标题 Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers 漏洞ID GHSA-9rcw-c2f9-2j55 影响版本 >= 5.2.0 >= 5.2.0 修复版本 5.4.0 5.4.0 严重性 Low (0.0 / 10) CVSS v3 基本指标 攻击向量: Local 攻击复杂度: High 所需权限: None 用户交互: None 范围: Unchanged 机密性影响: None 完整性影响: None 可用性影响: None CVE ID CVE-2025-54076 弱点 No CWEs 描述与影响 The function of the library may access uninitialized memory when the provided buffer length is empty and the position is not . This can lead to accessing arbitrary data outside the buffer bounds, causing unexpected behavior or a revert. 修复措施 Upgrade to version 5.4.0.