Vulnerability in OpenZeppelin Contracts Affecting Smart Contract Development
CVE-2025-54070

6.9MEDIUM

Key Information:

Vendor

Openzeppelin

Status
Openzeppelin-contracts
Vendor
CVE Published:
17 July 2025

What is CVE-2025-54070?

The lastIndexOf(bytes,byte,uint256) function in OpenZeppelin Contracts versions 5.2.0 to 5.3.0 may access uninitialized memory under specific conditions. If an empty buffer is provided and the position is not at its maximum value, this issue can lead to unexpected behavior, including invalid memory accesses. This has significant implications for contracts relying on accurate indexing, resulting in potential reverts or undefined behavior. Developers are urged to upgrade to version 5.4.0 to mitigate this vulnerability.

Affected Version(s)

openzeppelin-contracts >= 5.2.0, < 5.4.0

References

https://github.com/OpenZeppelin/openzeppelin-contracts/se...
x_refsource_CONFIRM
https://github.com/OpenZeppelin/openzeppelin-contracts/re...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-54070 : Vulnerability in OpenZeppelin Contracts Affecting Smart Contract Development