Description
A vulnerability was found in MicroPython up to 1.21.0. It has been classified as critical. Affected is the function slice_indices of the file objslice.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 1.22.0 is able to address this issue. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-249180.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | MicroPython | 1.13.0, 1.14.0, 1.15.0, 1.16.0, 1.17.0, 1.18.0, 1.19.0, 1.20.0, 1.21.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | giac | No fix yet | — |
| Ubuntu 26.04 LTS | giac | No fix yet | — |
| Ubuntu 25.10 | giac | No fix yet | — |
| Ubuntu 24.04 LTS | giac | No fix yet | — |
| Ubuntu 22.04 LTS | giac | No fix yet | — |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | giac | No fix yet | — |
| Ubuntu 18.04 LTS | giac | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | micropython | 1.22.0-1.1 | openSUSE-SU-2024:13566-1 |
Advisories 1
- openSUSE-SU-2024:13566-1 micropython-1.22.0-1.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
References
- https://vuldb.com/?id.249180 vdb-entry technical-description
- https://vuldb.com/?ctiid.249180 signature permissions-required
- https://github.com/micropython/micropython/issues/13007 exploit issue-tracking
- https://github.com/micropython/micropython/pull/13039 issue-tracking
- https://github.com/micropython/micropython/pull/13039/commits/f397a3ec318f3ad05aa287764ae7cef32202380f issue-tracking patch
- https://github.com/micropython/micropython/releases/tag/v1.22.0 patch
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/TEK46QAJOXXDZOWOIE2YACUOCZFWOBCK/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4E2HYWCZB5R4SHY4SZZZSFDMD64N4SOZ/
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/D3WWY5JY4RTJE25APB4REGDUDPATG6H7/