CVE-2026-114115
Received Received - Intake

Vyper Compiler Miscompilation in parse_IfExp Leading to Memory Corruption

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: VulnCheck

Description
Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing contracts to silently store corrupted values or revert.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-08
NVD
CVE-2026-114115
EUVD
EUVD-2026-106918

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vyperlang vyper 0.3.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-843 The product allocates or initializes a resource such as a pointer, object, or variable using one type, but it later accesses that resource using a type that is incompatible with the original type.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Vyper versions 0.3.8 through 0.5.0b1. It involves ternary expressions incorrectly handling nested arrays with different inner bounds. When a ternary selects a narrower array, the compiler reads it using the wider array's memory layout, causing misalignment. This leads to silent data corruption or unexpected reverts.

Detection Guidance

This vulnerability is specific to Vyper compiler versions 0.3.8 through 0.5.0b1 and relates to ternary expression handling. Detection requires checking Vyper compiler versions in use. Run 'vyper --version' to identify installed versions. If affected versions are found, review smart contracts compiled with these versions for ternary expressions involving nested arrays.

Impact Analysis

Contracts using affected Vyper versions may store corrupted values or revert unexpectedly due to misaligned memory reads. This can cause silent failures or incorrect behavior in smart contracts, especially when ternary expressions involve nested arrays with varying bounds.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a compiler miscompilation issue in Vyper that causes silent data corruption or unexpected reverts in smart contracts due to incorrect memory layout handling in ternary expressions. Compliance impacts would only occur if the vulnerability led to unauthorized data access, processing errors, or integrity violations in systems subject to these regulations.

Mitigation Strategies

Upgrade Vyper to the latest version beyond 0.5.0b1. Recompile all smart contracts using the patched compiler. Review contracts using ternary expressions with nested arrays for unexpected behavior. Monitor deployed contracts for reverted transactions or corrupted data.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114115. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...