High severity7.3NVD Advisory· Published Sep 17, 2024· Updated Jun 17, 2026
CVE-2024-8948
CVE-2024-8948
Description
A vulnerability was found in MicroPython 1.23.0. It has been rated as critical. Affected by this issue is the function mpz_as_bytes of the file py/objint.c. The manipulation leads to heap-based buffer overflow. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The patch is identified as 908ab1ceca15ee6fd0ef82ca4cba770a3ec41894. It is recommended to apply a patch to fix this issue. In micropython objint component, converting zero from int to bytes leads to heap buffer-overflow-write at mpz_as_bytes.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
micropython-copyPyPI | <= 3.3.3.post3 | — |
micropython-ioPyPI | <= 0.1 | — |
micropython-osPyPI | <= 0.8 | — |
Affected products
5- ghsa-coords3 versions
<= 3.3.3.post3+ 2 more
- (no CPE)range: <= 3.3.3.post3
- (no CPE)range: <= 0.1
- (no CPE)range: <= 0.8
(expand)+ 1 more
- (no CPE)
- cpe:2.3:a:micropython:micropython:1.23.0:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
10- github.com/micropython/micropython/commit/908ab1ceca15ee6fd0ef82ca4cba770a3ec41894nvdPatchWEB
- github.com/micropython/micropython/issues/13041nvdExploitIssue TrackingThird Party AdvisoryWEB
- github.com/advisories/GHSA-vh3x-525m-jp4rghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-8948ghsaADVISORY
- vuldb.comnvdThird Party AdvisoryWEB
- vuldb.comnvdThird Party AdvisoryWEB
- github.com/pypa/advisory-database/tree/main/vulns/micropython-copy/PYSEC-2024-87.yamlghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/micropython-io/PYSEC-2024-88.yamlghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/micropython-os/PYSEC-2024-89.yamlghsaWEB
- vuldb.comnvdPermissions RequiredWEB
News mentions
0No linked articles in our index yet.