CVE-2026-114118

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-114118
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114118.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-114118
Aliases
  • GHSA-fxg7-4wqg-c8gh
Published
2026-10-21T00:37:15Z
Modified
2026-10-21T10:45:45Z
Severity
  • 6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound
Details

Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens.

Database specific 
{
    "cna_assigner":  "VulnCheck",
    "cwe_ids":  [
        "CWE-681"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114118.json"
}
References

Affected packages

Git / github.com/vyperlang/vyper

Affected ranges

Type
GIT
Repo
https://github.com/vyperlang/vyper
Events
Introduced
f31f0ec406bbbd2055f125abd17278e3ac2ed84f
Last Affected
577d2534356903076bb79b5b15ebd4d772994693
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0.3.4"
                },
                {
                    "last_affected":  "0.5.0b1"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StandardRange"
        }
    ]
}

Affected versions

v0.*
v0.3.10
v0.3.10rc1
v0.3.10rc2
v0.3.10rc3
v0.3.10rc4
v0.3.10rc5
v0.3.4
v0.3.5
v0.3.6
v0.3.7
v0.3.8
v0.3.9
v0.4.0
v0.4.0b1
v0.4.0b2
v0.4.0b3
v0.4.0b4
v0.4.0b5
v0.4.0b6
v0.4.0rc1
v0.4.0rc2
v0.4.0rc3
v0.4.0rc4
v0.4.0rc5
v0.4.0rc6
v0.4.1
v0.4.1b1
v0.4.1b2
v0.4.1b3
v0.4.1b4
v0.4.1rc1
v0.4.1rc2
v0.4.1rc3
v0.4.2
v0.4.2rc1
v0.4.3
v0.4.3rc1
v0.5.0a1
v0.5.0a2
v0.5.0a3
v0.5.0b1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114118.json"