CVE-2025-54070

OpenZeppelin Contracts Bytes's lastIndexOf function with position argument performs out-of-bound memory access on empty buffers

Upgrade to 5.4.0

The lastIndexOf(bytes,byte,uint256) function of the Bytes.sol library may access uninitialized memory when the following two conditions hold: 1) the provided buffer length is empty (i.e. buffer.length == 0) and position is not 2**256 - 1 (i.e. pos != type(uint256).max).

The pos argument could be used to access arbitrary data outside of the buffer bounds. This could lead to the operation running out of gas, or returning an invalid index (outside of the empty buffer). Processing this invalid result for accessing the buffer would cause a revert under normal conditions.

When triggered, the function reads memory at offset buffer + 0x20 + pos. If memory at that location (outside the buffer) matches the search pattern, the function would return an out of bound index instead of the expected type(uint256).max. This creates unexpected behavior where callers receive a valid-looking index pointing outside buffer bounds.

Subsequent memory accesses that don't check bounds and use the returned index must carefully review the potential impact depending on their setup. Code relying on this function returning type(uint256).max for empty buffers or using the returned index without bounds checking could exhibit undefined behavior.

A read operation accesses a memory location beyond the intended buffer boundary. Typical impact: sensitive data disclosure or crash.

Kodem intelligence

Already deployed Kodem?

1. What is CVE-2025-54070? CVE-2025-54070 is a medium-severity out-of-bounds read vulnerability in @openzeppelin/contracts (npm), affecting versions >= 5.2.0, < 5.4.0. It is fixed in 5.4.0. A read operation accesses a memory location beyond the intended buffer boundary.
2. Which packages are affected by CVE-2025-54070?
   • @openzeppelin/contracts (npm) (versions >= 5.2.0, < 5.4.0)
   • @openzeppelin/contracts-upgradeable (npm) (versions >= 5.2.0, < 5.4.0)
3. Is there a fix for CVE-2025-54070? Yes. CVE-2025-54070 is fixed in 5.4.0. Upgrade to this version or later.
4. Is CVE-2025-54070 exploitable, and should I be worried? Whether CVE-2025-54070 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2025-54070 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2025-54070?
   • Upgrade @openzeppelin/contracts to 5.4.0 or later
   • Upgrade @openzeppelin/contracts-upgradeable to 5.4.0 or later

Other vulnerabilities in @openzeppelin/contracts