cve.bz

CVE-2023-26488

6.5 mediumEPSS 0.7%

Medium (6.5) in openzeppelin. EPSS 0.7% chance of exploitation in the next 30 days. Fixed in @openzeppelin/contracts 4.8.2.

OpenZeppelin Contracts is a library for secure smart contract development. The ERC721Consecutive contract designed for minting NFTs in batches does not update balances when a batch has size 1 and consists of a single token. Subsequent transfers from the receiver of that token may overflow the balance as reported by `balanceOf`. The issue exclusively presents with batches of size 1. The issue has been patched in 4.8.2.

Severity

CVSS 3.1

6.5 medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
EPSS
0.7% chance of exploitation in the next 30 days; higher than 53% of CVEs (scores of 2026-10-31)
CWE
CWE-682
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-878m-3g6q-594qnpm@openzeppelin/contracts>=4.8.0 <4.8.24.8.2
GHSA-878m-3g6q-594qnpm@openzeppelin/contracts-upgradeable>=4.8.0 <4.8.24.8.2

References

Check your stackJSON