CVE-2024-27094— OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
Quick assessment
Affected
OpenZeppelin openzeppelin-contracts
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
OpenZeppelin是一个应用软件。一个安全区块链应用的标准。 OpenZeppelin Contracts 5.0.2之前版本和4.9.6之前版本存在安全漏洞，该漏洞源于当该输入不是3的倍数时，Base64.encode函数最后一次迭代可以读取输入缓冲器之外的存储器部分。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2024-27094
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
OpenZeppelin Contracts base64 encoding may read from potentially dirty memory
Source: CVE Program / CVE List V5
Vulnerability Description
OpenZeppelin Contracts is a library for secure smart contract development. The `Base64.encode` function encodes a `bytes` input by iterating over it in chunks of 3 bytes. When this input is not a multiple of 3, the last iteration may read parts of the memory that are beyond the input buffer. The vulnerability is fixed in 5.0.2 and 4.9.6.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Vulnerability Title
OpenZeppelin 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
OpenZeppelin是一个应用软件。一个安全区块链应用的标准。 OpenZeppelin Contracts 5.0.2之前版本和4.9.6之前版本存在安全漏洞，该漏洞源于当该输入不是3的倍数时，Base64.encode函数最后一次迭代可以读取输入缓冲器之外的存储器部分。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| OpenZeppelin | openzeppelin-contracts | >= 4.5.0, < 4.9.6 | - |
|
II. Public POCs for CVE-2024-27094
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2024-27094
请登录查看更多情报信息。
Patches & Fixes for CVE-2024-27094 (4)
Vendor Advisories for CVE-2024-27094 (1)
IV. Related Vulnerabilities
Same product: openzeppelin-contracts
-
CVE-2025-54070
OpenZeppelin Contracts's Bytes's lastIndexOf function with p -
CVE-2023-49798
Duplicated execution of subcalls in OpenZeppelin Contracts -
CVE-2023-40014
OpenZeppelin Contracts's ERC2771Context with custom forwarde -
CVE-2023-34459
OpenZeppelin Contracts's MerkleProof multiproofs may allow p -
CVE-2023-34234
Governor proposal creation may be blocked by frontrunning in
Same vendor: OpenZeppelin
-
CVE-2026-57583
OpenZeppelin Contracts Wizard: Line terminators in info.secu -
CVE-2026-73645
OpenZeppelin Confidential Contracts ERC7984ERC20Wrapper: onc -
CVE-2026-48054
OpenZeppelin Contracts Wizard has Code Injection in Generate -
CVE-2025-54070
OpenZeppelin Contracts's Bytes's lastIndexOf function with p -
CVE-2024-45304
OwnableTwoStep allows a pending owner to accept ownership af
Same weakness: CWE-125
-
CVE-2026-111274
unarr through 1.1.1 Heap Out-of-Bounds Read via zip_parse_ex -
CVE-2026-111272
LibRaw through 0.22.2 Heap Out-of-Bounds Read via parseNikon -
CVE-2026-111271
libmodplug through 0.8.9.1 Heap Out-of-Bounds Read via CSoun -
CVE-2026-111269
libical through 4.0.6 Heap Out-of-Bounds Read via icalvalue_ -
CVE-2024-58397
MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::Get
V. Comments for CVE-2024-27094
No comments yet