Vulnerability Description
Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing contracts to silently store corrupted values or revert.
CVSS Score
LOW
Related Weaknesses (CWE)
References
- https://github.com/vyperlang/vyper/commit/1fb7dfe2
- https://github.com/vyperlang/vyper/security/advisories/GHSA-cw3h-xwxq-8cx2
- https://www.vulncheck.com/advisories/vyper-0.3.8-through-0.5-0b1-memory-misread-
FAQ
What is CVE-2026-114115?
CVE-2026-114115 is a vulnerability with a CVSS score of 3.7 (LOW). Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a tern...
How severe is CVE-2026-114115?
CVE-2026-114115 has been rated LOW with a CVSS base score of 3.7/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-114115?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.