CVE-2026-114118 vyperlang CVE debrief

Who should care

Defenders responsible for Ethereum-based applications and smart contracts using Vyper should assess the potential impact of this vulnerability and verify the versions of Vyper used in their projects.

Why it matters

CVE-2026-114118 is a medium-severity vulnerability in Vyper that can allow an attacker to deploy contracts with no runtime code, potentially trapping ETH and tokens. Defenders responsible for Ethereum-based applications and smart contracts using Vyper should assess the potential impact and verify the versions of Vyper used in their projects.

• Potential trapping of ETH and tokens due to deployment of contracts with no runtime code
• Verification of Vyper versions used in projects is necessary to assess exposure
• Review and update of Vyper configurations may be required to prevent exploitation

Technical summary

The vulnerability is caused by the lack of proper checking of the `code_offset` in the `create_from_blueprint` function, which can lead to a wrap-around error and allow an attacker to deploy contracts with no runtime code. This issue affects Vyper versions from 0.3.4 through 0.5.0b1. Defenders should prioritize verifying the versions of Vyper used in their projects and assess the potential impact on their Ethereum-based applications. The vulnerability was reported by Vulncheck and is described in the CVE Program record and the NVD vulnerability detail page.

Defensive priority

Defenders should prioritize verifying the versions of Vyper used in their projects and assess the potential impact on their Ethereum-based applications.

Recommended defensive actions

• Verify Vyper versions used in projects
• Assess potential impact on Ethereum-based applications
• Review and update Vyper configurations
• Confirm whether affected Vyper deployments exist in managed environments and assign an owner for follow-up.
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The vulnerability was reported by Vulncheck and is described in the CVE Program record and the NVD vulnerability detail page. The issue is related to the Vyper language and its handling of blueprint sizes.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.