# CVE-2023-26488: OpenZeppelin Contracts incorrect balance calculation in ERC721Consecutive

Source: https://junglewise.ai/threats/cve-2023-26488-openzeppelin-contracts-incorrect-balance-calculation-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-03-03. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2023-26488 · Severity: low · CVSS 3.1 · Published 2023-03-03

OpenZeppelin Contracts is a widely-used library for building smart contracts on blockchain platforms. The ERC721Consecutive component, which handles batch minting of non-fungible tokens (NFTs), fails to properly update token balances when processing batches of size 1. This can cause balance overflows when tokens are subsequently transferred, allowing attackers to manipulate token balances and potentially steal or duplicate tokens.

Technologies: [@openzeppelin/contracts (npm)](https://junglewise.ai/threats/technologies/openzeppelin-contracts), [@openzeppelin/contracts-upgradeable (npm)](https://junglewise.ai/threats/technologies/openzeppelin-contracts-upgradeable), [OpenZeppelin Contracts](https://junglewise.ai/threats/technologies/contracts), [OpenZeppelin Contracts Upgradeable](https://junglewise.ai/threats/technologies/contracts-upgradeable). Vendors: [npm](https://junglewise.ai/threats/vendors/npm), [OpenZeppelin](https://junglewise.ai/threats/vendors/openzeppelin).

## Quick answers

**Is CVE-2023-26488 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-26488 being exploited in the wild.

**How severe is CVE-2023-26488?** Low severity, with a CVSS score of 3.1, published 3 March 2023.

**Which products and versions are affected?** @openzeppelin/contracts (npm) SEMVER:introduced=4.8.0,fixed=4.8.2; @openzeppelin/contracts-upgradeable (npm) SEMVER:introduced=4.8.0,fixed=4.8.2; OpenZeppelin Contracts >=4.8.0, <4.8.2; OpenZeppelin Contracts Upgradeable >=4.8.0, <4.8.2.

**Is there a fix for CVE-2023-26488?** Yes. @openzeppelin/contracts (npm): upgrade to 4.8.2 or later; @openzeppelin/contracts-upgradeable (npm): upgrade to 4.8.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2023-26488 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2023-26488?** Check whether you run @openzeppelin/contracts (npm), @openzeppelin/contracts-upgradeable (npm), OpenZeppelin Contracts or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @openzeppelin/contracts (npm): upgrade to 4.8.2 or later

  ```sh
  npm install @openzeppelin/contracts@4.8.2
  ```

- @openzeppelin/contracts-upgradeable (npm): upgrade to 4.8.2 or later

  ```sh
  npm install @openzeppelin/contracts-upgradeable@4.8.2
  ```


## Technical details

The vulnerability exists in the ERC721Consecutive contract's batch minting logic, which contains an incorrect calculation that fails to update the balance mapping when a batch contains exactly one token. This issue (CWE-682: Incorrect Calculation) only affects batch size 1. When a single token is minted in a batch, the receiver's balance is not incremented in the balanceOf tracking. Subsequent transfers from the receiver can then cause integer overflow in the balance calculation. The vulnerability affects versions 4.8.0 through 4.8.1 of both @openzeppelin/contracts and @openzeppelin/contracts-upgradeable, and has been patched in version 4.8.2. No authentication is required; any caller able to perform batch minting of size 1 can trigger the flaw.

## Affected products

- OpenZeppelin Contracts >=4.8.0, <4.8.2
- OpenZeppelin Contracts Upgradeable >=4.8.0, <4.8.2

## Identifiers

- CVE-2023-26488
- GHSA-878m-3g6q-594q

## Timeline

- 2023-03-03: disclosed: GHSA advisory published
- 2023-03-03: patched: Fix released in version 4.8.2

## References

- [https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-878m-3g6q-594q](https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-878m-3g6q-594q)

## Related threats

- [OpenZeppelin Contracts information disclosure in VestingWalletConfidential](https://junglewise.ai/threats/openzeppelin-confidential-contracts-vestingwalletconfidential-a-14aa72cf)
- [OpenZeppelin Contracts out-of-bounds memory access in Bytes.lastIndexOf](https://junglewise.ai/threats/cve-2025-54070-openzeppelin-contracts-out-of-bounds-memory-access-in-bytes)
- [OpenZeppelin Contracts base64 encoding reads from dirty memory](https://junglewise.ai/threats/cve-2024-27094-openzeppelin-contracts-base64-encoding-reads-from-dirty-memory)
- [OpenZeppelin Contracts duplicated execution in Multicall](https://junglewise.ai/threats/cve-2023-49798-openzeppelin-contracts-duplicated-execution-in-multicall)
- [OpenZeppelin Contracts improper escaping in ERC2771Context](https://junglewise.ai/threats/cve-2023-40014-openzeppelin-contracts-improper-escaping-in-erc2771context)