CVE-2026-114114 vyperlang CVE debrief

Who should care

Defenders responsible for systems using Vyper versions 0.1.0b1 through 0.5.0b1 should assess exposure and prioritize verification and remediation efforts. This includes operators, platform administrators, vulnerability management teams, and security teams who need to review and update affected systems and dependencies.

Why it matters

Defenders should prioritize verifying and remediating Vyper versions 0.1.0b1 through 0.5.0b1 due to the potential for silent literal value substitution, which may lead to unauthorized changes in compiled code.

• Silent substitution of addresses, integers, or other constants in compiled code may occur
• Potential for unauthorized changes to code behavior
• Need for verification of Vyper versions and dependencies
• Remediation priority for affected systems and dependencies

Technical summary

The Vyper compiler incorrectly handles multi-byte characters, allowing for literal value substitution in compiled code. An attacker can contribute source code with non-ASCII identifiers that NFKC-normalize to ASCII or use an invisible byte-order mark to substitute addresses, integers, or other constants. The vulnerability affects Vyper versions 0.1.0b1 through 0.5.0b1 and can lead to silent substitution of addresses, integers, or other constants in compiled code. Defenders should prioritize verifying Vyper versions 0.1.0b1 through 0.5.0b1 for potential literal value substitution vulnerabilities.

Defensive priority

Defenders should prioritize verifying Vyper versions 0.1.0b1 through 0.5.0b1 for potential literal value substitution vulnerabilities, especially in environments using multi-byte characters.

Recommended defensive actions

• Verify Vyper versions 0.1.0b1 through 0.5.0b1 for potential literal value substitution vulnerabilities
• Update to Vyper version 0.1.0b12 or later, 0.1.0b15 or later, or 0.5.0b2 or later as available
• Review and update affected systems and dependencies
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability in Vyper versions 0.1.0b1 through 0.5.0b1. The vulnerability allows for literal value substitution via multi-byte characters, potentially leading to silent substitution of addresses, integers, or other constants in compiled code.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.