CVE-2024-8947
MicroPython objarray.c use after free
A vulnerability was found in MicroPython 1.22.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file py/objarray.c. The manipulation leads to use after free. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.23.0 is able to address this issue. The identifier of the patch is 4bed614e707c0644c06e117f848fa12605c711cd. It is recommended to upgrade the affected component. In micropython objarray component, when a bytes object is resized and copied into itself, it may reference memory that has already been freed.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
MicroPython objarray.c use after free
A vulnerability was found in MicroPython 1.22.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file py/objarray.c. The manipulation leads to use after free. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.23.0 is able to address this issue. The identifier of the patch is 4bed614e707c0644c06e117f848fa12605c711cd. It is recommended to upgrade the affected component. In micropython objarray component, when a bytes object is resized and copied into itself, it may reference memory that has already been freed.
- Record
CVE-2024-8947- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 3.0
- 5.6 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 5.1
AV:N/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
EUVDEUVD-2024-0103
A vulnerability was found in MicroPython 1.22.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file py/objarray.c. The manipulation leads to use after free. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.23.0 is able to address this issue. The identifier of the patch is 4bed614e707c0644c06e117f848fa12605c711cd. It is recommended to upgrade the affected component. In micropython objarray component, when a bytes object is resized and copied into itself, it may reference memory that has already been freed.
- Record
EUVD-2024-0103- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-pwwp-3q7j-9mx8
Use After Free in MicroPython
A vulnerability was found in MicroPython 1.22.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file py/objarray.c. The manipulation leads to use after free. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.23.0 is able to address this issue. The identifier of the patch is 4bed614e707c0644c06e117f848fa12605c711cd. It is recommended to upgrade the affected component. In micropython objarray component, when a bytes object is resized and copied into itself, it may reference memory that has already been freed.
- Record
GHSA-pwwp-3q7j-9mx8- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-416
- Updated
- 2026-11-02
NVD
A vulnerability was found in MicroPython 1.22.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file py/objarray.c. The manipulation leads to use after free. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.23.0 is able to address this issue. The identifier of the patch is 4bed614e707c0644c06e117f848fa12605c711cd. It is recommended to upgrade the affected component. In micropython objarray component, when a bytes object is resized and copied into itself, it may reference memory that has already been freed.
- Record
CVE-2024-8947- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-416
- Updated
- 2026-11-02
OSV
MicroPython objarray.c use after free
A vulnerability was found in MicroPython 1.22.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file py/objarray.c. The manipulation leads to use after free. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.23.0 is able to address this issue. The identifier of the patch is 4bed614e707c0644c06e117f848fa12605c711cd. It is recommended to upgrade the affected component. In micropython objarray component, when a bytes object is resized and copied into itself, it may reference memory that has already been freed.
- Record
CVE-2024-8947- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2024-8947
A vulnerability was found in MicroPython 1.22.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file py/objarray.c. The manipulation leads to use after free. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.23.0 is able to address this issue. The identifier of the patch is 4bed614e707c0644c06e117f848fa12605c711cd. It is recommended to upgrade the affected component. In micropython objarray component, when a bytes object is resized and copied into itself, it may reference memory that has already been freed.
- Record
DEBIAN-CVE-2024-8947- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-pwwp-3q7j-9mx8
Use After Free in MicroPython
A vulnerability was found in MicroPython 1.22.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file py/objarray.c. The manipulation leads to use after free. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.23.0 is able to address this issue. The identifier of the patch is 4bed614e707c0644c06e117f848fa12605c711cd. It is recommended to upgrade the affected component. In micropython objarray component, when a bytes object is resized and copied into itself, it may reference memory that has already been freed.
- Record
GHSA-pwwp-3q7j-9mx8- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-416
- Updated
- 2026-11-02
OSVPYSEC-2024-92
A vulnerability was found in MicroPython 1.22.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file py/objarray.c. The manipulation leads to use after free. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.23.0 is able to address this issue. The identifier of the patch is 4bed614e707c0644c06e117f848fa12605c711cd. It is recommended to upgrade the affected component. In micropython objarray component, when a bytes object is resized and copied into itself, it may reference memory that has already been freed.
- Record
PYSEC-2024-92- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVPYSEC-2024-94
A vulnerability was found in MicroPython 1.22.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file py/objarray.c. The manipulation leads to use after free. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.23.0 is able to address this issue. The identifier of the patch is 4bed614e707c0644c06e117f848fa12605c711cd. It is recommended to upgrade the affected component. In micropython objarray component, when a bytes object is resized and copied into itself, it may reference memory that has already been freed.
- Record
PYSEC-2024-94- CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2024-8947
A vulnerability was found in MicroPython 1.22.2. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file py/objarray.c. The manipulation leads to use after free. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. Upgrading to version 1.23.0 is able to address this issue. The identifier of the patch is 4bed614e707c0644c06e117f848fa12605c711cd. It is recommended to upgrade the affected component. In micropython objarray component, when a bytes object is resized and copied into itself, it may reference memory that has already been freed.
- Record
UBUNTU-CVE-2024-8947- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 8.1 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10704-1 No score
micropython-1.28.0-2.1 on GA media
These are all security issues fixed in the micropython-1.28.0-2.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10704-1- Updated
- 2026-11-02
OSVUSN-7472-1 No score
micropython vulnerabilities
Junwha Hong and Wonil Jang discovered that Micropython incorrectly handled the length of a buffer in mp_vfs_umount, leading to a heap-based buffer overflow vulnerability. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2024-8946)
Junwha Hong and Wonil Jang discovered that Micropython incorrectly handled memory, leading to a use-after-free vulnerability under certain circumstances. If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2024-8947)
It was discovered that Middleware USB Host MCU Component incorrectly handled memory, leading to a buffer overflow vulnerability, If a user or automated system were tricked into opening a specially crafted file, an attacker could possibly use this issue to cause a denial of service or possibly execute arbitrary code. (CVE-2021-42553)
- Record
USN-7472-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
micropython-copyPyPI |
through 3.3.3.post3 | None known |
micropython-ioPyPI |
through 0.1 | None known |
micropythonDebian:13 |
before 1.24.0+ds-1 | 1.24.0+ds-1 |
micropythonDebian:14 |
before 1.24.0+ds-1 | 1.24.0+ds-1 |
micropython-copyPyPI |
through 3.3.3.post3, plus listed versions 0.0.10.0.23.3.3-2 |
None known |
micropython-ioPyPI |
through 0.1, plus listed versions 0.0.10.0.20.0.3 |
None known |
micropython-copyPyPI |
All versions, plus listed versions 0.0.10.0.23.3.3-23.3.3.post3 |
None known |
micropython-ioPyPI |
All versions, plus listed versions 0.0.10.0.20.0.30.1v1.22.0 Show 45 moreShow lessv1.23.0-previewv1.22.0-previewv1.21.0v1.20.0v1.19.1v1.19v1.18v1.17v1.16v1.15v1.14v1.13v1.12v1.11v1.10v1.9.4v1.9.3v1.9.2v1.9.1v1.9v1.8.7v1.8.6v1.8.5v1.8.4v1.8.3v1.8.2v1.8.1v1.8v1.7v1.6v1.5.2v1.5.1v1.5v1.4.6v1.4.5v1.4.4v1.4.3v1.4.2v1.4.1v1.4v1.3.10v1.3.9v1.3.8v1.3.7v1.3.6 |
None known |
micropythonUbuntu:Pro:20.04:LTS |
before 1.12-1ubuntu0.1~esm1, plus listed versions 1.12-1 |
1.12-1ubuntu0.1~esm1 |
micropythonUbuntu:Pro:22.04:LTS |
before 1.17+ds-1.1ubuntu2+esm1, plus listed versions 1.17+ds-1ubuntu11.17+ds-1.11.17+ds-1.1ubuntu2 |
1.17+ds-1.1ubuntu2+esm1 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
micropythonUbuntu:Pro:24.04:LTS |
before 1.22.1+ds-1ubuntu0.24.04.1~esm1, plus listed versions 1.19.1+ds-11.22.1+ds-11.22.1+ds-1build11.22.1+ds-1build2 |
1.22.1+ds-1ubuntu0.24.04.1~esm1 |
micropythonUbuntu:Pro:20.04:LTS From an advisory covering 3 CVEs |
before 1.12-1ubuntu0.1~esm1, plus listed versions 1.12-1 |
1.12-1ubuntu0.1~esm1 |
micropythonUbuntu:Pro:22.04:LTS From an advisory covering 3 CVEs |
before 1.17+ds-1.1ubuntu2+esm1, plus listed versions 1.17+ds-1ubuntu11.17+ds-1.11.17+ds-1.1ubuntu2 |
1.17+ds-1.1ubuntu2+esm1 |
micropythonUbuntu:Pro:24.04:LTS From an advisory covering 3 CVEs |
before 1.22.1+ds-1ubuntu0.24.04.1~esm1, plus listed versions 1.19.1+ds-11.22.1+ds-11.22.1+ds-1build11.22.1+ds-1build2 |
1.22.1+ds-1ubuntu0.24.04.1~esm1 |
micropythonopenSUSE:Tumbleweed |
before 1.28.0-2.1 | 1.28.0-2.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-8947 is a medium vulnerability (CVSS 6.3) in Micropython, published September 17, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.02%, the 63rd percentile. Fixed in micropython 1.24.0+ds-1.
References
vuldb.com?id.277765
github.com/micropython/micropython/issues/13283
Show 12 moreShow less
nvd.nist.gov/vuln/detail/CVE-2024-8947
security-tracker.debian.org/tracker/CVE-2024-8947
ubuntu.com/security/CVE-2024-8947
cve.org/CVERecord?id=CVE-2024-8947
suse.com/security/cve/CVE-2024-8947
Left out here: 12 versions. The JSON record has them.