CVE-2025-54070

{"id": "CVE-2025-54070", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-54070", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-07-17T20:27:49.503221Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "OpenZeppelin", "product": "openzeppelin-contracts", "versions": [{"status": "affected", "version": ">= 5.2.0, < 5.4.0"}]}]}], "published": "2025-07-17T19:15:25.623", "references": [{"url": "https://github.com/OpenZeppelin/openzeppelin-contracts/releases/tag/v5.4.0", "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9rcw-c2f9-2j55", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}]}], "descriptions": [{"lang": "en", "value": "OpenZeppelin Contracts is a library for secure smart contract development. Starting in version 5.2.0 and prior to version 5.4.0, the `lastIndexOf(bytes,byte,uint256)` function of the `Bytes.sol` library may access uninitialized memory when the following two conditions hold: 1) the provided buffer length is empty (i.e. `buffer.length == 0`) and position is not `2**256 - 1` (i.e. `pos != type(uint256).max`). The `pos` argument could be used to access arbitrary data outside of the buffer bounds. This could lead to the operation running out of gas, or returning an invalid index (outside of the empty buffer). Processing this invalid result for accessing the `buffer` would cause a revert under normal conditions. When triggered, the function reads memory at offset `buffer + 0x20 + pos`. If memory at that location (outside the\u00a0`buffer`) matches the search pattern, the function would return an out of bound index instead of the expected `type(uint256).max`. This creates unexpected behavior where callers receive a valid-looking index pointing outside buffer bounds. Subsequent memory accesses that don't check bounds and use the returned index must carefully review the potential impact depending on their setup. Code relying on this function returning `type(uint256).max` for empty buffers or using the returned index without bounds checking could exhibit undefined behavior. Users should upgrade to version 5.4.0 to receive a patch."}, {"lang": "es", "value": "OpenZeppelin Contracts es una librer\u00eda para el desarrollo seguro de contratos inteligentes. A partir de la versi\u00f3n 5.2.0 y anteriores a la 5.4.0, la funci\u00f3n `lastIndexOf(bytes,byte,uint256)` de la librer\u00eda `Bytes.sol` puede acceder a memoria no inicializada cuando se cumplen las dos condiciones siguientes: 1) la longitud del b\u00fafer proporcionado est\u00e1 vac\u00eda (es decir, `buffer.length == 0`) y la posici\u00f3n no es `2**256 - 1` (es decir, `pos != type(uint256).max`). El argumento `pos` podr\u00eda usarse para acceder a datos arbitrarios fuera de los l\u00edmites del b\u00fafer. Esto podr\u00eda provocar que la operaci\u00f3n se quede sin gas o que devuelva un \u00edndice no v\u00e1lido (fuera del b\u00fafer vac\u00edo). Procesar este resultado no v\u00e1lido para acceder al `buffer` provocar\u00eda una reversi\u00f3n en condiciones normales. Cuando se activa, la funci\u00f3n lee la memoria en el desplazamiento `buffer + 0x20 + pos`. Si la memoria en esa ubicaci\u00f3n (fuera del b\u00fafer) coincide con el patr\u00f3n de b\u00fasqueda, la funci\u00f3n devolver\u00eda un \u00edndice fuera de los l\u00edmites en lugar del `type(uint256).max` esperado. Esto genera un comportamiento inesperado: quienes llaman reciben un \u00edndice aparentemente v\u00e1lido que apunta fuera de los l\u00edmites del b\u00fafer. Los accesos posteriores a memoria que no verifiquen los l\u00edmites y utilicen el \u00edndice devuelto deben revisar cuidadosamente el posible impacto seg\u00fan su configuraci\u00f3n. El c\u00f3digo que dependa de que esta funci\u00f3n devuelva `type(uint256).max` para b\u00faferes vac\u00edos o que utilice el \u00edndice devuelto sin verificar los l\u00edmites podr\u00eda presentar un comportamiento indefinido. Los usuarios deben actualizar a la versi\u00f3n 5.4.0 para recibir una actualizaci\u00f3n."}], "lastModified": "2026-06-17T09:39:21.917", "sourceIdentifier": "security-advisories@github.com"}