CVE-2026-114114

Deferred Deferred - Pending Action

Integer Overflow in Vyper Smart Contract Compiler

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-21

EPSS Evaluated

2026-11-08

NVD

CVE-2026-114114

EUVD

EUVD-2026-106917

Affected Vendors & Products

Vendor	Product	Version / Range
vyperlang	vyper	0.1.0b1
vyperlang	vyper	0.1.0b14
vyperlang	vyper	0.4.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-176	The product does not properly handle when an input contains Unicode encoding.

Attack-Flow Graph

Executive Summary

This vulnerability affects Vyper versions through 0.5.0b1. It occurs because the parser mixes character-based line offsets with Python's UTF-8 byte column offsets. Multi-byte characters like non-ASCII identifiers or byte-order marks can shift source slices, causing numeric literals, addresses, or constants in compiled code to be silently substituted without detection.

Detection Guidance

Check Vyper version with 'vyper --version' to see if it falls within vulnerable ranges (>=0.1.0b1,<0.1.0b12; >=0.1.0b14,<0.1.0b15; >=0.4.1,<=0.5.0b1). Inspect source files for non-ASCII characters or byte-order marks that could normalize to ASCII and alter numeric literals.

Impact Analysis

An attacker could exploit this to alter critical values in smart contracts, such as addresses, integers, or other constants. This could lead to unauthorized changes in contract behavior, financial losses, or manipulation of contract logic without being detected during compilation.

Compliance Impact

This vulnerability primarily affects the integrity of compiled smart contracts by allowing silent substitution of numeric literals or addresses through multi-byte characters. While it does not directly impact data privacy or security controls required by GDPR or HIPAA, it could lead to non-compliance if exploited to alter critical values in systems handling protected health information or personal data.

Mitigation Strategies

Upgrade Vyper to a patched version. For versions between 0.1.0b1 and 0.1.0b12, upgrade to 0.1.0b12 or later. For versions 0.4.1 through 0.5.0b1, upgrade to 0.5.0b2 or later. Review and sanitize source code to remove non-ASCII characters outside comments.

Hi! I’m here to help you understand CVE-2026-114114. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...