# Security Fix in Motoko (dfx 0.24.3)

**URL:** https://forum.dfinity.org/t/security-fix-in-motoko-dfx-0-24-3/38656
**Category:** Motoko
**Created:** [December 9, 2024, 3:52pm UTC](https://forum.dfinity.org/t/security-fix-in-motoko-dfx-0-24-3/38656 "2024-12-09T15:52:26Z")
**Posts on this page:** 1
**Page:** 1

<div class="post-metadata">

### Author: ![luc-blaeser](https://sea1.discourse-cdn.com/flex023/user_avatar/forum.dfinity.org/luc-blaeser/32/7410_2.png) [@luc-blaeser](https://forum.dfinity.org/u/luc-blaeser)
#### Post date: [December 9, 2024, 3:52pm UTC](https://forum.dfinity.org/t/security-fix-in-motoko-dfx-0-24-3/38656/1 "2024-12-09T15:52:26Z")

</div>

We encountered a bug in the Motoko runtime system that, under specific circumstances, could lead to unwanted memory writes or reads. Programs are only affected if they use the incremental garbage collector (compile option `—incremental-gc`) or enhanced orthogonal persistence (compile-option `--enhanced-orthogonal-persistence`). The bug is hard to trigger, as it depends on heap constellations, GC scheduling, and the use of specific language features at a large or frequent scale.

The bug is fixed in the recent Motoko release 0.14.3 deployed in `dfx` version 0.24.3. If you are using the incremental garbage collector or enhanced orthogonal persistence, we strongly recommend you to upgrade your Motoko program with the latest dfx.

Instructions:

1. Download or upgrade to latest dfx 0.24.3 or higher:

```auto

dfxvm update

```

1. For all your Motoko applications on IC:

```auto

dfx deploy —network ic

```

We also have a GitHub security advisory for this: GH advisory: [Uninitialized memory access in Motoko incremental garbage collector · Advisory · dfinity/motoko · GitHub](https://github.com/dfinity/motoko/security/advisories/GHSA-9rhg-3qf8-hrv3#event-381426)

If you have any questions, please do not hesitate to contact us via [team-motoko@dfinity.org](mailto:team-motoko@dfinity.org)

Many thanks  
Luc