# OpenZeppelin Contracts information disclosure in VestingWalletConfidential

Source: https://junglewise.ai/threats/openzeppelin-confidential-contracts-vestingwalletconfidential-a-14aa72cf  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-25. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

Severity: high · Published 2026-09-25

OpenZeppelin Contracts includes a vesting wallet component for confidential token releases on encrypted blockchains. A malicious token can trick the vesting wallet into revealing private balance information by exploiting a missing access control check. While funds cannot be stolen, an attacker can discover confidential financial data that the wallet holds access to.

Technologies: [OpenZeppelin Contracts](https://junglewise.ai/threats/technologies/contracts). Vendors: [OpenZeppelin](https://junglewise.ai/threats/vendors/openzeppelin).

## Quick answers

**Is This vulnerability exploited in the wild?** No. Junglewise Threat Intelligence has no report of This vulnerability being exploited in the wild.

**How severe is This vulnerability?** High severity, published 25 September 2026.

**Which products and versions are affected?** OpenZeppelin Contracts before v0.3.2, v0.4.2, v0.5.2.

**Is there a fix for This vulnerability?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is This vulnerability attacked?** It is attacked over the network, in a software library.

**Am I affected?** Check whether you run OpenZeppelin Contracts at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

VestingWalletConfidential and ERC7984 fail to verify that an external party has access control list (ACL) authorization before using encrypted handles returned by untrusted token contracts. A malicious ERC-7984 token can supply an alternative handle via confidentialBalanceOf, causing the vesting wallet to derive and grant access to private euint64 handles without validating the token's authorization; similarly, ERC7984 transfer callbacks can return unauthorized ebool values to leak plaintext via refund logic.

## Affected products

- OpenZeppelin Contracts before v0.3.2, v0.4.2, v0.5.2

## Timeline

- 2026-09-25: disclosed

## Related threats

- [OpenZeppelin Contracts out-of-bounds memory access in Bytes.lastIndexOf](https://junglewise.ai/threats/cve-2025-54070-openzeppelin-contracts-out-of-bounds-memory-access-in-bytes)
- [OpenZeppelin Contracts base64 encoding reads from dirty memory](https://junglewise.ai/threats/cve-2024-27094-openzeppelin-contracts-base64-encoding-reads-from-dirty-memory)
- [OpenZeppelin Contracts duplicated execution in Multicall](https://junglewise.ai/threats/cve-2023-49798-openzeppelin-contracts-duplicated-execution-in-multicall)
- [OpenZeppelin Contracts improper escaping in ERC2771Context](https://junglewise.ai/threats/cve-2023-40014-openzeppelin-contracts-improper-escaping-in-erc2771context)
- [OpenZeppelin Contracts MerkleProof multiproof verification bypass](https://junglewise.ai/threats/cve-2023-34459-openzeppelin-contracts-merkleproof-multiproof-verification-bypass)