Skip to content
Fencer Vulns
none 0.0

CVE-2025-54070 json

OpenZeppelin Contracts's Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers

published 2025-07-17 15 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-21789 , GHSA-9rcw-c2f9-2j55

cvss
0.0
version 3.1, GitHub
cisa kev
Not listed
not in CISA's catalog
epss
0.4%
EPSS 0.4% chance of exploitation in 30 days, percentile 34%
public exploits
0
none known

Summary

OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 5.2.0 and prior to version 5.4.0, the `lastIndexOf(bytes,byte,uint256)` function of the `Bytes.sol` library may access uninitialized memory when the following two conditions hold: 1) the provided buffer length is empty (i.e. `buffer.length == 0`) and position is not `2**256 - 1` (i.e. `pos != type(uint256).max`). The `pos` argument could be used to access arbitrary data outside of the buffer bounds. This could lead to the operation running out of gas, or returning an invalid index (outside of the empty buffer). Processing this invalid result for accessing the `buffer` would cause a revert under normal conditions. When triggered, the function reads memory at offset `buffer + 0x20 + pos`. If memory at that location (outside the `buffer`) matches the search pattern, the function would return an out of bound index instead of the expected `type(uint256).max`. This creates unexpected behavior where callers receive a valid-looking index pointing outside buffer bounds. Subsequent memory accesses that don't check bounds and use the returned index must carefully review the potential impact depending on their setup. Code relying on this function returning `type(uint256).max` for empty buffers or using the returned index without bounds checking could exhibit undefined behavior. Users should upgrade to version 5.4.0 to receive a patch.

Patch / fix

  • npm @openzeppelin/contracts 5.4.0
  • npm @openzeppelin/contracts-upgradeable 5.4.0
  • openzeppelin contracts_upgradeable 5.4.0
  • openzeppelin openzeppelin_contracts-upgradable 5.4.0
  • openzeppelin openzeppelin_contracts-upgradeable 5.4.0
  • openzeppelin contracts 5.4.0
  • openzeppelin openzeppelin_contracts 5.4.0

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
15 mo ago

Exploit prediction

0.40% chance of exploitation in the next 30 days, higher than 34% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
GitHub 3.1 0.0 CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N
CNA 4.0 6.9 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
npm @openzeppelin/contracts
>=5.2.0, <5.4.0
5.4.0
npm @openzeppelin/contracts-upgradeable
>=5.2.0, <5.4.0
5.4.0

Affected products

  • OpenZeppelin openzeppelin-contracts

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.