CVE-2026-114117 vyperlang CVE debrief

Who should care

Defenders responsible for Vyper contracts and deployments should assess exposure and verify affected versions. This includes operators of Vyper-based systems, security teams managing vulnerability response, and platform administrators overseeing affected components. They should prioritize verifying affected Vyper versions and assessing exposure in their environments to prevent potential incorrect recording of deposits and locking of funds.

Why it matters

Defenders should prioritize verifying affected Vyper versions and assessing exposure in their environments to prevent potential incorrect recording of deposits and locking of funds.

• Incorrect recording of deposits
• Locking of funds due to miscompilation

Technical summary

The vulnerability occurs in Vyper versions 0.3.8 through 0.5.0b1, where the optimizer miscompiles (msg.value | K) or (len(msg.data) | K) in ternary branches, leading to incorrect values being used in storage writes, arithmetic, indexes, return values, or events. This miscompilation can result in incorrect recording of deposits and locking of funds without warning or revert. The issue is specific to the optimizer's handling of bitwise OR operations with nonzero integer literals in ternary expressions under -O gas (the default) or -O codesize.

Defensive priority

Defenders should prioritize verifying affected Vyper versions and assessing exposure in their environments.

Recommended defensive actions

• Verify Vyper versions in use and assess exposure
• Review contracts for potential incorrect recording of deposits
• Consider upgrading to a non-affected version of Vyper
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The vulnerability is described in the CVE record and source item from cve_program_cvelist_v5. The affected versions of Vyper are 0.3.8 through 0.5.0b1. Evidence is limited to public CVE details and source item descriptions. Defenders should verify affected Vyper versions in their environments and review contracts for potential miscompilation impacts.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.