Vulnerability	Vulnerable Version
M Out-of-bounds Read @openzeppelin/contracts is a library for contract development. Affected versions of this package are vulnerable to Out-of-bounds Read due to the `Base64.encode` function. An attacker can corrupt the output by manipulating the extra bits that are kept between the encoding and padding when the input is not a multiple of 3, leading to parts of the memory beyond the input buffer being read. Note: These conditions are more frequent in the following scenarios: A bytes memory struct is allocated just after the input and the first bytes of it are non-zero. The memory pointer is set to a non-empty memory location before allocating the input. How to fix Out-of-bounds Read? Upgrade `@openzeppelin/contracts` to version 4.9.6, 5.0.2 or higher.	>=4.5.0 <4.9.6>=5.0.0-rc.0 <5.0.2

Out-of-bounds Read

@openzeppelin/contracts is a library for contract development.

Affected versions of this package are vulnerable to Out-of-bounds Read due to the Base64.encode function. An attacker can corrupt the output by manipulating the extra bits that are kept between the encoding and padding when the input is not a multiple of 3, leading to parts of the memory beyond the input buffer being read.

Note: These conditions are more frequent in the following scenarios:

A bytes memory struct is allocated just after the input and the first bytes of it are non-zero.
The memory pointer is set to a non-empty memory location before allocating the input.

How to fix Out-of-bounds Read?

Upgrade @openzeppelin/contracts to version 4.9.6, 5.0.2 or higher.

>=4.5.0 <4.9.6>=5.0.0-rc.0 <5.0.2

Go back to all versions of this package