{
  "cveId": "CVE-2024-8947",
  "url": "https://patchblox.com/security/cve/CVE-2024-8947",
  "summary": "CVE-2024-8947 is fixed in micropython on 1 platform, first by micropython 1.12-1ubuntu0.1~esm1, released September 17, 2024. It is not reported as exploited. Patch Radar priority: High.",
  "title": "micropython: A vulnerability was found in MicroPython 1.22.2",
  "description": "A vulnerability was found in MicroPython 1.22.2. It has been declared ascritical. Affected by this vulnerability is an unknown functionality of thefile py/objarray.c. The manipulation leads to use after free. The attackcan be launched remotely. The complexity of an attack is rather high. Theexploitation appears to be difficult. Upgrading to version 1.23.0 is ableto address this issue. The identifier of the patch is4bed614e707c0644c06e117f848fa12605c711cd. It is recommended to upgrade theaffected component. In micropython objarray component, when a bytes objectis resized and copied into itself, it may reference memory that has alreadybeen freed.",
  "published": "2024-09-17T12:15:00Z",
  "severity": "Medium",
  "cvss": 8.1,
  "cvssVector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.01021,
  "epssPercentile": 0.63624,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "micropython",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "1.24.0\u002Bds-1",
      "fix": "DEBIAN-CVE-2024-8947",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-8947",
      "released": "2024-09-17T19:15:29Z"
    },
    {
      "platform": "linux",
      "product": "micropython",
      "release": "Debian 14",
      "fixedVersion": "1.24.0\u002Bds-1",
      "fix": "DEBIAN-CVE-2024-8947",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-8947",
      "released": "2024-09-17T19:15:29Z"
    },
    {
      "platform": "linux",
      "product": "micropython",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "1.12-1ubuntu0.1~esm1",
      "fix": "micropython 1.12-1ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-micropython-1.12-1ubuntu0.1-esm1",
      "released": "2024-09-17T12:15:00Z"
    },
    {
      "platform": "linux",
      "product": "micropython",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "1.17\u002Bds-1.1ubuntu2\u002Besm1",
      "fix": "micropython 1.17\u002Bds-1.1ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-micropython-1.17-ds-1.1ubuntu2-esm1",
      "released": "2024-09-17T12:15:00Z"
    },
    {
      "platform": "linux",
      "product": "micropython",
      "release": "Ubuntu 24.04.5 LTS (noble)",
      "fixedVersion": "1.22.1\u002Bds-1ubuntu0.24.04.1~esm1",
      "fix": "micropython 1.22.1\u002Bds-1ubuntu0.24.04.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-noble-micropython-1.22.1-ds-1ubuntu0.24.04.1-esm1",
      "released": "2024-09-17T12:15:00Z"
    },
    {
      "platform": "linux",
      "product": "micropython",
      "release": "Ubuntu 24.10 (oracular)",
      "fixedVersion": "1.22.1\u002Bds-1ubuntu0.24.10.1",
      "fix": "micropython 1.22.1\u002Bds-1ubuntu0.24.10.1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-oracular-micropython-1.22.1-ds-1ubuntu0.24.10.1",
      "released": "2026-01-16T01:42:22Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T00:53:09Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}