CVE Feed

    Dashboard / CVE / CVE-2026-114114

    CVE-2026-114114

    Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code.

    Published:Oct 21, 2026
    Last Modified:Oct 28, 2026
    EPS:Oct 21, 2026
    EPSS Score:0.00183
    CVSS Score:5.3

    Affected Products

    Vendor
    Vyperlang
    Product
    Vyper

    Exploits

    No exploit reference

    Related CVEs

    CVE-2026-114663 (CVSS 8.6) — Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported mod…
    CVE-2026-114118 (CVSS 6.3) — Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtract…
    CVE-2026-114117 (CVSS 8.2) — Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | …
    CVE-2026-114116 (CVSS 6) — Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), wh…
    CVE-2026-114115 (CVSS 6.3) — Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested …
    CVE-2021-48020 (CVSS 8.3) — Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip po…
    CVE-2021-48019 (CVSS 6.3) — Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a f…
    CVE-2021-48018 (CVSS 8.3) — Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locatio…
    CVE-2020-37289 (CVSS 6.3) — Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decim…
    CVE-2020-37288 (CVSS 6.3) — Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an inter…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High