CVE-2024-26149
published 2024-02-26CVE-2024-26149: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in…
PriorityP427medium5.3CVSS 3.1
AVNACLPRNUINSUCLINAN
EPSS
0.54%
41.8th percentile
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within `_abi_decode`. This vulnerability affects 0.3.10 and earlier versions.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vyperlang | vyper | <= 0.3.10 | — |
| vyperlang | vyper | >= 0 < 0.4.0b1 | 0.4.0b1 |
| vyperlang | vyper | >= 0 < 0.4.0 | 0.4.0 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2024-26149: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
osv·2024-02-26
CVE-2024-26149 CVE-2024-26149: Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within `_abi_decode`. This vulnerability affects 0.3.10 and earlier versions.
GHSA
Vyper's `_abi_decode` vulnerable to Memory Overflow
ghsa·2024-02-26
CVE-2024-26149 [LOW] CWE-119 Vyper's `_abi_decode` vulnerable to Memory Overflow
Vyper's `_abi_decode` vulnerable to Memory Overflow
## Summary
If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to bugs in contracts that use arrays within `_abi_decode`. The advisory has been assigned low severity, because it is only observable if there is a memory write between two invocations of `abi_decode` on the same input.
## Proof of Concept
```vyper
event Pwn:
pass
@external
def f(x: Bytes[32 * 3]):
a: Bytes[32] = b"foo"
y: Bytes[32 * 3] = x
decoded_y1: Bytes[32] = _abi_decode(y, Bytes[32])
a = b"bar"
decoded_y2: Bytes[32] = _abi_decode(y, Bytes[32])
if decoded_y1 != decoded_y2:
log Pwn()
```
OSV
Vyper's `_abi_decode` vulnerable to Memory Overflow
osv·2024-02-26
CVE-2024-26149 [LOW] Vyper's `_abi_decode` vulnerable to Memory Overflow
Vyper's `_abi_decode` vulnerable to Memory Overflow
## Summary
If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to bugs in contracts that use arrays within `_abi_decode`. The advisory has been assigned low severity, because it is only observable if there is a memory write between two invocations of `abi_decode` on the same input.
## Proof of Concept
```vyper
event Pwn:
pass
@external
def f(x: Bytes[32 * 3]):
a: Bytes[32] = b"foo"
y: Bytes[32 * 3] = x
decoded_y1: Bytes[32] = _abi_decode(y, Bytes[32])
a = b"bar"
decoded_y2: Bytes[32] = _abi_decode(y, Bytes[32])
if decoded_y1 != decoded_y2:
log Pwn()
```
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2024-02-26
Published