CVE-2025-54070
BaseFortify
Publication date: 2025-07-17
Last updated on: 2025-07-17
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| openzeppelin | contracts-upgradeable | 5.2.0 |
| openzeppelin | contracts-upgradeable | 5.4.0 |
| openzeppelin | contracts | 5.4.0 |
| openzeppelin | contracts | 5.2.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability affects the lastIndexOf(bytes, byte, uint256) function in the Bytes.sol library of OpenZeppelin Contracts versions 5.2.0 up to but not including 5.4.0. When called on an empty buffer with a position argument not equal to the maximum uint256 value, the function reads memory outside the buffer bounds. If the out-of-bounds memory matches the search byte, the function returns an invalid index pointing outside the buffer instead of the expected maximum value. This can cause unexpected behavior such as running out of gas, returning invalid indices, or causing reverts if the returned index is used without proper bounds checking. [1]
How can this vulnerability impact me? :
The vulnerability can cause your smart contract code to behave unexpectedly if it relies on lastIndexOf returning the maximum uint256 value for empty buffers or uses the returned index without bounds checking. This may lead to out-of-gas errors, invalid index returns, or transaction reverts. The impact depends on how the returned index is used in your code. It does not directly affect confidentiality, integrity, or availability, but can cause undefined behavior or failures in contract execution. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is specific to the `lastIndexOf(bytes, byte, uint256)` function in the OpenZeppelin Contracts library versions >= 5.2.0 and < 5.4.0. Detection involves identifying usage of these vulnerable versions in your smart contracts or dependencies. Since it is a code-level issue, you can detect it by checking the version of OpenZeppelin Contracts used in your project. For example, you can run commands like `npm list @openzeppelin/contracts` or `yarn list @openzeppelin/contracts` in your project directory to see the installed version. Additionally, reviewing smart contract code for calls to `lastIndexOf` with empty buffers and non-maximum `pos` values can help identify potential triggers. There are no specific network commands to detect this vulnerability as it is a local code issue. [1]
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to upgrade the OpenZeppelin Contracts package to version 5.4.0 or later, where the vulnerability has been patched. This upgrade fixes the `lastIndexOf` function to correctly handle empty buffers and positions, preventing out-of-bounds memory access. Avoid using vulnerable versions (>= 5.2.0 and < 5.4.0) in your projects. Additionally, review your code to ensure that any use of the `lastIndexOf` function properly checks bounds and handles the returned index safely. [1, 2]