Compiler Miscompilation in Vyper by Vyperlang
CVE-2026-114115

6.3MEDIUM

Key Information:

Vendor

Vyperlang

Status
Vyper
Vendor
CVE Published:
21 October 2026

What is CVE-2026-114115?

The vulnerability in Vyper versions 0.3.8 through 0.5.0b1 arises from a miscompilation in the parse_IfExp function. It affects how nested arrays with narrower inner bounds are processed when using a ternary selection. This results in inner arrays being accessed at incorrect offsets, which can lead to contracts storing corrupted values silently or reverting unexpectedly. This flaw has significant implications for smart contract integrity, potentially introducing critical errors in blockchain applications.

Affected Version(s)

vyper 0.3.8 <= 0.5.0b1

References

https://github.com/vyperlang/vyper/security/advisories/GH...
vendor-advisory
https://github.com/vyperlang/vyper/commit/1fb7dfe2
patch
https://www.vulncheck.com/advisories/vyper-0.3.8-through-...
third-party-advisory

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

harkal
.