CVE-2026-114117
Received Received - Intake

Vyper Compiler Miscompilation in msg.value and msg.data Handling

Publication date: 2026-10-21

Last updated on: 2026-10-21

Assigner: VulnCheck

Description
Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-21
Last Modified
2026-10-21
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-08
NVD
CVE-2026-114117
EUVD
EUVD-2026-106920

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
vyperlang vyper 0.3.8

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-682 The product performs a calculation that generates incorrect or unintended results that are later used in security-critical decisions or resource management.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Vyper versions 0.3.8 through 0.5.0b1. When the optimizer is enabled (default or -O codesize), expressions like (msg.value | K) or (len(msg.data) | K) in ternary branches are incorrectly compiled to the constant 1. This causes smart contracts to use wrong values in storage writes, arithmetic, array indexes, return values, or events without warnings or reverts.

Detection Guidance

Check Vyper compiler versions in use. Run `vyper --version` to identify if versions 0.3.8 through 0.5.0b1 are deployed. Review smart contract source code for ternary expressions using msg.value or len(msg.data) with bitwise OR operations. Audit optimizer settings in compilation commands for -O gas or -O codesize flags.

Impact Analysis

This flaw can lead to incorrect deposit recording and potential fund locking in affected smart contracts. For example, a deposit function using (msg.value | 1) if flag else msg.value would record all deposits with the flag set as 1, trapping funds in the contract.

Compliance Impact

This vulnerability primarily affects smart contracts written in Vyper by causing incorrect handling of msg.value and msg.data in ternary expressions under default optimization settings. While it does not directly violate GDPR or HIPAA, it could lead to financial losses or data integrity issues in systems handling sensitive data, potentially impacting compliance with regulations requiring accurate transaction records and fund management.

Mitigation Strategies

Upgrade Vyper to versions outside the vulnerable range. Disable optimizer flags by using -O none during compilation. Review and test all smart contracts for incorrect behavior in ternary branches involving msg.value or len(msg.data).

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-114117. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...