CVE-2026-114114
published 2026-10-21CVE-2026-114114: Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in…
PriorityP428medium5.3CVSS 3.1
AVNACHPRNUIRSUCNIHAN
EPSS
0.18%
7.5th percentile
Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vyperlang | vyper | >= 0.1.0b1 < 0.1.0b12 | 0.1.0b12 |
| vyperlang | vyper | >= 0.1.0b14 < 0.1.0b15 | 0.1.0b15 |
| vyperlang | vyper | 0.4.1 – 0.5.0b1 | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv4.06.0MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-114114 vyper: Vyper: Silent constant substitution in compiled code via multi-byte character parsing [fedora-all]
bugzilla·2026-10-21·CVSS 5.3
CVE-2026-114114 [MEDIUM] CVE-2026-114114 vyper: Vyper: Silent constant substitution in compiled code via multi-byte character parsing [fedora-all]
CVE-2026-114114 vyper: Vyper: Silent constant substitution in compiled code via multi-byte character parsing [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compi
Bugzilla
CVE-2026-114114 vyper: Vyper: Silent constant substitution in compiled code via multi-byte character parsing
bugzilla·2026-10-21·CVSS 5.3
CVE-2026-114114 [MEDIUM] CVE-2026-114114 vyper: Vyper: Silent constant substitution in compiled code via multi-byte character parsing
CVE-2026-114114 vyper: Vyper: Silent constant substitution in compiled code via multi-byte character parsing
Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code.
2026-10-21
Published