A vulnerability was found in MicroPython 1.23.0. It has been rated as critical. Affected by this issue is the function mpz_as_bytes of the file py/objint.c. The manipulation leads to heap-based buffer
A vulnerability was found in MicroPython 1.23.0. It has been rated as critical. Affected by this issue is the function mpz_as_bytes of the file py/objint.c. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 908ab1ceca15ee6fd0ef82ca4cba770a3ec41894. It is recommended to apply a patch to fix this issue. In micropython objint component, converting zero from int to bytes leads to heap buffer-overflow-write at mpz_as_bytes.
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Python (PyPI) | micropython-copy | all versions | no fix |
| Python (PyPI) | micropython-io | all versions | no fix |
| Python (PyPI) | micropython-os | all versions | no fix |
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-8948
- https://github.com/micropython/micropython/issues/13041
- https://github.com/micropython/micropython/commit/908ab1ceca15ee6fd0ef82ca4cba770a3ec41894
- https://github.com/pypa/advisory-database/tree/main/vulns/micropython-copy/PYSEC-2024-87.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/micropython-io/PYSEC-2024-88.yaml
- https://github.com/pypa/advisory-database/tree/main/vulns/micropython-os/PYSEC-2024-89.yaml
- https://vuldb.com/?ctiid.277766
- https://vuldb.com/?id.277766
- https://vuldb.com/?submit.409317
- https://github.com/advisories/GHSA-vh3x-525m-jp4r
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H- Weakness (CWE)
CWE-122, CWE-787- Platform
- Python (PyPI)
- Package
micropython-copy, micropython-io, micropython-os- Disclosed
- 17.09.2024
- Updated
- 11.10.2026 12:20
Sources and licenses
OSV / GitHub Advisory Database - PYSEC-2024-87 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2024-88 - PyPA Advisory Database; CC BY 4.0
OSV / GitHub Advisory Database - GHSA-vh3x-525m-jp4r - CC BY 4.0
OSV / GitHub Advisory Database - PYSEC-2024-89 - PyPA Advisory Database; CC BY 4.0
Vulnerability history: micropython-os
All published vulnerabilities of this package (Python (PyPI)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 2
- First → latest
- 12.2023 09.2024
- Without a fix
- 2
- Exploited in attacks
- 0
Severity breakdown
- Critical 1
- High 1
Disclosures per year
- 2023: 1
- 2024: 1
- 2025: 0
- 2026: 0
-
A vulnerability was found in MicroPython 1.23.0. It has been rated as critical. Affected by this issue is the function mpz_as_bytes of the file py/objint.c. The manipulation leads to heap-based buffer this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.