CVE-2024-8948
MicroPython objint.c mpz_as_bytes heap-based overflow
- Published
- Updated
- Reserved
- Assigned by
- VulDB
Description
A vulnerability was found in MicroPython 1.23.0. It has been rated as critical. Affected by this issue is the function mpz_as_bytes of the file py/objint.c. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 908ab1ceca15ee6fd0ef82ca4cba770a3ec41894. It is recommended to apply a patch to fix this issue. In micropython objint component, converting zero from int to bytes leads to heap buffer-overflow-write at mpz_as_bytes.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| VulDBCNA (assigner) | 4.0 | Medium6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N |
| VulDBCNA (assigner) | 3.1 | High7.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| VulDBCNA (assigner) | 3.0 | High7.3 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L |
| VulDBCNA (assigner) | 2.0 | High7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| NVDNVD · Analyzed | 4.0 | Medium6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
- EPSS (exploitation in 30 days)
- 0.98% · top 37% of all CVEs (6 Nov 2026)
- CISA SSVC
- Exploitation: poc · Automatable: no · Technical impact: partial
The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.9.
Weakness
Affected products
MicroPython
- affected 1.23.0
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- PyPImicropython-copyGHSA-vh3x-525m-jp4r (opens in a new tab)
- PyPImicropython-ioGHSA-vh3x-525m-jp4r (opens in a new tab)
- PyPImicropython-osGHSA-vh3x-525m-jp4r (opens in a new tab)
References (5)
- VDB-277766 | MicroPython objint.c mpz_as_bytes heap-based overflow (opens in a new tab)vdb-entrytechnical-description
- VDB-277766 | CTI Indicators (IOB, IOC, IOA) (opens in a new tab)signaturepermissions-required
- Submit #409317 | micropython v1.23.0 Buffer Overflow (opens in a new tab)third-party-advisory
- https://github.com/micropython/micropython/issues/13041 (opens in a new tab)exploitissue-tracking
- https://github.com/micropython/micropython/commit/908ab1ceca15ee6fd0ef82ca4cba770a3ec41894 (opens in a new tab)patch
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-vh3x-525m-jp4r (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2024-8948)Record last updated .