CVE-2026-114115

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-114115

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114115.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-114115

Aliases

GHSA-cw3h-xwxq-8cx2

Published

2026-10-21T00:37:13Z

Modified

2026-10-21T10:45:46Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Vyper 0.3.8 through 0.5.0b1 Memory Misread via Ternary Nested Array Selection

Details

Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing contracts to silently store corrupted values or revert.

Database specific

{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-843"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114115.json"
}

References

Affected packages

Git / github.com/vyperlang/vyper

Affected ranges

Type

GIT

Repo

https://github.com/vyperlang/vyper

Events

Introduced

036f153683e0d55b890305eb4c77680a0872fcba

Last Affected

577d2534356903076bb79b5b15ebd4d772994693

Fixed

1fb7dfe2

Database specific

Show details

{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.3.8"
                },
                {
                    "last_affected":  "0.5.0b1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        },
        {
            "range":  [
                {
                    "fixed":  "1fb7dfe2"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v0.*

v0.3.10

v0.3.10rc1

v0.3.10rc2

v0.3.10rc3

v0.3.10rc4

v0.3.10rc5

v0.3.8

v0.3.9

v0.4.0

v0.4.0b1

v0.4.0b2

v0.4.0b3

v0.4.0b4

v0.4.0b5

v0.4.0b6

v0.4.0rc1

v0.4.0rc2

v0.4.0rc3

v0.4.0rc4

v0.4.0rc5

v0.4.0rc6

v0.4.1

v0.4.1b1

v0.4.1b2

v0.4.1b3

v0.4.1b4

v0.4.1rc1

v0.4.1rc2

v0.4.1rc3

v0.4.2

v0.4.2rc1

v0.4.3

v0.4.3rc1

v0.5.0a1

v0.5.0a2

v0.5.0a3

v0.5.0b1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114115.json"