CVE Feed

    Dashboard / CVE / CVE-2026-114115

    CVE-2026-114115

    Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing contracts to silently store corrupted values or revert.

    Published:Oct 21, 2026
    Last Modified:Oct 22, 2026
    EPS:Oct 21, 2026
    EPSS Score:0.00277
    CVSS Score:3.7

    Affected Products

    Vendor
    Vyperlang
    Product
    Vyper

    Exploits

    No exploit reference

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-114663 (CVSS 8.6) — Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported mod…
    CVE-2026-114118 (CVSS 6.3) — Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtract…
    CVE-2026-114117 (CVSS 8.2) — Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | …
    CVE-2026-114116 (CVSS 6) — Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), wh…
    CVE-2026-114114 (CVSS 6) — Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Pytho…
    CVE-2021-48020 (CVSS 8.3) — Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip po…
    CVE-2021-48019 (CVSS 6.3) — Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a f…
    CVE-2021-48018 (CVSS 8.3) — Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locatio…
    CVE-2020-37289 (CVSS 6.3) — Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decim…
    CVE-2020-37288 (CVSS 6.3) — Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an inter…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High