# CVE-2024-27094: OpenZeppelin Contracts base64 encoding reads from dirty memory

Source: https://junglewise.ai/threats/cve-2024-27094-openzeppelin-contracts-base64-encoding-reads-from-dirty-memory  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2024-02-29. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2024-27094 · Severity: low · CVSS 3.1 · Published 2024-02-29

OpenZeppelin Contracts is a widely-used library for secure smart contract development. The Base64.encode function can read uninitialized memory beyond the input buffer when processing inputs that aren't multiples of 3 bytes, potentially leaking sensitive data or corrupting encoded output. An attacker could exploit this in scenarios where memory layout is predictable to extract or manipulate sensitive information.

Technologies: [OpenZeppelin Contracts](https://junglewise.ai/threats/technologies/contracts), [OpenZeppelin Contracts Upgradeable](https://junglewise.ai/threats/technologies/contracts-upgradeable). Vendors: [OpenZeppelin](https://junglewise.ai/threats/vendors/openzeppelin).

## Quick answers

**Is CVE-2024-27094 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2024-27094 being exploited in the wild.

**How severe is CVE-2024-27094?** Low severity, with a CVSS score of 3.1, published 29 February 2024.

**Which products and versions are affected?** OpenZeppelin Contracts 4.5.0 to 5.0.1; OpenZeppelin Contracts Upgradeable 4.5.0 to 5.0.1.

**Is there a fix for CVE-2024-27094?** A patch was published on 2024-02-29: Patches released: versions 4.9.6 and 5.0.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2024-27094 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2024-27094?** Check whether you run OpenZeppelin Contracts or OpenZeppelin Contracts Upgradeable at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a buffer over-read (CWE-125) in the Base64.encode function. When the input byte length is not a multiple of 3, the iteration logic reads up to 2 bytes beyond the allocated input buffer. Although the output is padded correctly, 4 bits of uninitialized ("dirty") memory are retained in the encoded data before padding, corrupting the base64 output if adjacent memory is non-zero. The attack vector is network (contracts deployed on-chain), requires no authentication or user interaction, and affects versions 4.5.0–5.0.1 of @openzeppelin/contracts and @openzeppelin/contracts-upgradeable. Patches are available in versions 4.9.6 and 5.0.2.

## Affected products

- OpenZeppelin Contracts 4.5.0 to 5.0.1
- OpenZeppelin Contracts Upgradeable 4.5.0 to 5.0.1

## Identifiers

- CVE-2024-27094
- GHSA-9vx6-7xxf-x967

## Timeline

- 2024-02-29: disclosed: Advisory GHSA-9vx6-7xxf-x967 published
- 2024-02-29: patched: Patches released: versions 4.9.6 and 5.0.2

## References

- [https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9vx6-7xxf-x967](https://github.com/OpenZeppelin/openzeppelin-contracts/security/advisories/GHSA-9vx6-7xxf-x967)

## Related threats

- [OpenZeppelin Contracts information disclosure in VestingWalletConfidential](https://junglewise.ai/threats/openzeppelin-confidential-contracts-vestingwalletconfidential-a-14aa72cf)
- [OpenZeppelin Contracts out-of-bounds memory access in Bytes.lastIndexOf](https://junglewise.ai/threats/cve-2025-54070-openzeppelin-contracts-out-of-bounds-memory-access-in-bytes)
- [OpenZeppelin Contracts duplicated execution in Multicall](https://junglewise.ai/threats/cve-2023-49798-openzeppelin-contracts-duplicated-execution-in-multicall)
- [OpenZeppelin Contracts improper escaping in ERC2771Context](https://junglewise.ai/threats/cve-2023-40014-openzeppelin-contracts-improper-escaping-in-erc2771context)
- [OpenZeppelin Contracts MerkleProof multiproof verification bypass](https://junglewise.ai/threats/cve-2023-34459-openzeppelin-contracts-merkleproof-multiproof-verification-bypass)