CVE-2025-54070: OpenZeppelin Contracts lastIndexOf Function Vulnerability Leading to Out-of-Bound Memory Access
Summary
CVE-2025-54070: Impact The lastIndexOf(bytes,byte,uint256) function of the Bytes.sol library may access uninitialized memory when the following two conditions hold: 1) the provided buffer length is empty (i.e. Affects @openzeppelin/contracts versions >= 5.2.0, < 5.4.0. Fixed in 5.4.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
OpenZeppelin Contracts is a widely used library in the Ethereum ecosystem, providing secure and reusable smart contract components. The library includes various utilities for developing decentralized applications, ensuring that developers can implement complex functionalities without compromising security. However, a vulnerability has been identified in the 'lastIndexOf' function of the Bytes.sol library, which can lead to unintended memory access issues.
Vulnerability Detail
The vulnerability arises in the 'lastIndexOf(bytes, byte, uint256)' function when the provided buffer length is empty and the position argument is not set to the maximum uint256 value. This can cause the function to access uninitialized memory, potentially leading to gas exhaustion or returning an invalid index. If the function reads memory at an out-of-bounds location that matches the search pattern, it may return a valid-looking index outside the buffer bounds, resulting in undefined behavior for subsequent memory accesses.
How To Fix
Minimum fixed version
5.4.0
This is the first release that contains the fix.
npm install @openzeppelin/contracts@5.4.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, ensure that any calls to the 'lastIndexOf' function are made with a non-empty buffer or validate the position argument before invoking the function to prevent out-of-bounds access.
Conclusion
In summary, CVE-2025-54070 represents a significant vulnerability in the OpenZeppelin Contracts library that can lead to out-of-bounds memory access. It is crucial for developers using this library to upgrade to the patched version to mitigate potential risks. Implementing proper checks and using tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for @openzeppelin/contracts →
FAQ
CVE-2025-54070 is a vulnerability in the OpenZeppelin Contracts library that affects the 'lastIndexOf' function, allowing for potential out-of-bounds memory access.
If your application uses the affected version of the OpenZeppelin Contracts library, it may experience unexpected behavior, including gas exhaustion or invalid memory access, which could lead to contract failures.
If an immediate upgrade is not possible, implement checks to ensure that the buffer is not empty and validate the position argument before calling the 'lastIndexOf' function.
You can use Vulert to monitor your project for open-source vulnerabilities. It analyzes your package-lock.json file to alert you in real-time. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
The CVSS score for this vulnerability is 0.0, indicating a moderate level of risk associated with its exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for @openzeppelin/contracts.
