CVE-2026-114115 vyperlang CVE debrief

Who should care

Defenders responsible for Vyper-based systems, particularly those using versions 0.3.8 through 0.5.0b1, should assess exposure and prioritize patching or mitigation. Those responsible for Vyper-based systems should verify their environment, prioritize patching, and monitor for unusual activity. This includes verifying affected Vyper versions, reviewing contracts, and applying patches or mitigations as available.

Why it matters

Defenders should care about CVE-2026-114115 because it affects Vyper versions 0.3.8 through 0.5.0b1, potentially leading to silent corruption of contract values or reversion. Those responsible for Vyper-based systems should verify their environment, prioritize patching, and monitor for unusual activity.

• Potential silent corruption of contract values
• Possible reversion of contracts due to incorrect memory reads
• Need for verification of affected Vyper versions in the environment
• Priority on applying patches or mitigations

Technical summary

The vulnerability is caused by a compiler miscompilation in the parse_IfExp function of Vyper versions 0.3.8 through 0.5.0b1. This miscompilation leads to incorrect memory layout usage for nested arrays with narrower inner bounds, potentially causing contracts to store corrupted values or revert. The issue affects Vyper-based systems using versions 0.3.8 through 0.5.0b1, and defenders should prioritize verifying the affected Vyper versions in their environment and applying patches or mitigations as available. The vulnerability can be addressed by updating to a patched version of Vyper.

Defensive priority

Defenders should prioritize verifying the affected Vyper versions in their environment and applying patches or mitigations as available.

Recommended defensive actions

• Verify Vyper versions 0.3.8 through 0.5.0b1 are not in use or apply patches
• Review contracts for potential corruption or reversion
• Monitor for unusual activity or errors in Vyper-based systems
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description, affected versions, and references to vendor advisories and patches. The vulnerability was identified in Vyper versions 0.3.8 through 0.5.0b1. Defenders should verify their environment, prioritize patching, and monitor for unusual activity. Evidence is limited to publicly available information, and further verification is necessary to confirm affected systems.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.