Description
A vulnerability was found in MicroPython 1.23.0. It has been classified as critical. Affected is the function mp_vfs_umount of the file extmod/vfs.c of the component VFS Unmount Handler. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. The name of the patch is 29943546343c92334e8518695a11fc0e2ceea68b. It is recommended to apply a patch to fix this issue. In the VFS unmount process, the comparison between the mounted path string and the unmount requested string is based solely on the length of the unmount string, which can lead to a heap buffer overflow read.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | MicroPython | 1.23.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | micropython | 1.24.0+ds-1 | — |
| Debian 13 | micropython | 1.24.0+ds-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 24.04 LTS | micropython | 1.22.1+ds-1ubuntu0.24.04.1~esm1 | USN-7472-1 |
| Ubuntu Pro 22.04 LTS | micropython | 1.17+ds-1.1ubuntu2+esm1 | USN-7472-1 |
| Ubuntu Pro 20.04 LTS | micropython | 1.12-1ubuntu0.1~esm1 | USN-7472-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | micropython-copy | <= 3.3.3.post3 | — | GHSA-74qm-4v7r-jw2f |
| PyPI | micropython-copy | all versions | — | PYSEC-2024-91 |
| PyPI | micropython-io | <= 0.1 | — | GHSA-74qm-4v7r-jw2f |
| PyPI | micropython-io | all versions | — | PYSEC-2024-93 |
| PyPI | micropython-os-path | <= 0.1.3 | — | GHSA-74qm-4v7r-jw2f |
| PyPI | micropython-os-path | all versions | — | PYSEC-2024-95 |
| PyPI | micropython-string | <= 0.1 | — | GHSA-74qm-4v7r-jw2f |
| PyPI | micropython-string | all versions | — | PYSEC-2024-96 |
Advisories 1
- USN-7472-1 micropython vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
References
- VDB-277764 | MicroPython VFS Unmount vfs.c mp_vfs_umount heap-based overflow vdb-entry technical-description
- VDB-277764 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- Submit #409312 | micropython v1.23.0 Heap-based Buffer Overflow third-party-advisory
- https://github.com/micropython/micropython/issues/13006 exploit issue-tracking
- https://github.com/micropython/micropython/issues/13006#issuecomment-1820309455 issue-tracking
- https://github.com/micropython/micropython/commit/29943546343c92334e8518695a11fc0e2ceea68b patch