CVE-2026-114118
published 2026-10-21CVE-2026-114118: Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is…
PriorityP424medium4.8CVSS 3.1
AVNACHPRNUINSUCNILAL
EPSS
0.20%
9.5th percentile
Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| vyperlang | vyper | 0.3.4 – 0.5.0b1 | — |
CVSS provenance
nvdv3.14.8MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L
nvdv4.06.3MEDIUMCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-114118 vyper: Vyper: Deployment of empty smart contracts via integer underflow in create_from_blueprint
bugzilla·2026-10-21·CVSS 4.8
CVE-2026-114118 [MEDIUM] CVE-2026-114118 vyper: Vyper: Deployment of empty smart contracts via integer underflow in create_from_blueprint
CVE-2026-114118 vyper: Vyper: Deployment of empty smart contracts via integer underflow in create_from_blueprint
Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens.
Bugzilla
CVE-2026-114118 vyper: Vyper: Deployment of empty smart contracts via integer underflow in create_from_blueprint [fedora-all]
bugzilla·2026-10-21·CVSS 4.8
CVE-2026-114118 [MEDIUM] CVE-2026-114118 vyper: Vyper: Deployment of empty smart contracts via integer underflow in create_from_blueprint [fedora-all]
CVE-2026-114118 vyper: Vyper: Deployment of empty smart contracts via integer underflow in create_from_blueprint [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens.
2026-10-21
Published