GHSA-853p-5678-hv8f · Severity: medium · Ecosystem: rust — ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`
ink! is an embedded domain specific language to write smart contracts in Rust for blockchains built on the Substrate framework. Starting in version 4.0.0 and prior to version 4.2.1, the return value when using delegate call mechanics, either through `CallBuilder::delegate` or `ink_env::invoke_contract_delegate`, is decoded incorrectly. This bug was related to the mechanics around decoding a call's return buffer, which was changed as part of pull request 1450. Since this feature was only released in ink! 4.0.0, no previous versions are affected. Users who have an ink! 4.x series contract should upgrade to 4.2.1 to receive a patch.
Conclusion & alert: CVE-2023-34449 is rated Exploit Available (57/100): CVSS Medium severity, with medium exploitation likelihood (EPSS 0.97%). Core evidence: 3 public exploit reference(s) are indexed (Exploit-DB). Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ | |
| — | nvd_ref | exploit_tag | Exploit-DB ↗ | |
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 0.18% | 0.97% | +0.79% |
| 2 | 2025-11-21 | 0.30% | 0.18% | -0.12% |
| 3 | 2025-11-18 | — | 0.30% | — |
Full EPSS history (10 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 5.3 | 3.1 | MEDIUM |
|
3.9 | 1.4 | [email protected] |
| 5.3 | 3.1 | MEDIUM |
|
3.9 | 1.4 | [email protected] |
GHSA-853p-5678-hv8f · Severity: medium · Ecosystem: rust — ink! vulnerable to incorrect decoding of storage value when using `DelegateCall`
| URL | Tags |
|---|---|
| https://docs.rs/ink_env/4.2.0/ink_env/call/struct.CallBuilder.html#method.delegate | Exploit Third Party Advisory |
| https://docs.rs/ink_env/4.2.0/ink_env/fn.invoke_contract_delegate.html | Exploit Third Party Advisory |
| https://github.com/paritytech/ink/commit/f1407ee9f87e5f64d467a22d26ee88f61db7f3db | Patch |
| https://github.com/paritytech/ink/pull/1450 | Patch Vendor Advisory |
| https://github.com/paritytech/ink/security/advisories/GHSA-853p-5678-hv8f | Exploit Patch Vendor Advisory |