Read the docs
TI-2024-16182 Aliases CVE-2024-24561GHSA-9x7f-gwxq-6f2c

Vyper bounds check on built-in `slice()` function can be overflowed

Priority HIGH 82CWE-119Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-119 and the CVSS impact.

Summary

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for the ability for start + length to overflow when the values aren't literals. If a slice() function uses a non-literal argument for the start or length variable, this creates the ability for an attacker to overflow the bounds check. This issue can be used to do OOB access to storage, memory or calldata addresses. It can also be used to corrupt the length slot of the respective array.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00902 59th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed vyper (PyPI): 0.4.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vyperlangvyperup to 0.3.10—No fix listedCNA
—vyper (PyPI)before 0.4.00.4.0Patch availableGHSA-9x7f-gwxq-6f2c
  • vyper Vendorvyperlang Affected up to 0.3.10 Fixed in — No fix listed CNA
  • vyper (PyPI) Vendor— Affected before 0.4.0 Fixed in 0.4.0 Patch available GHSA-9x7f-gwxq-6f2c

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:python:*:*up to 0.3.10Vulnerablevyperlang
  • cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:python:*:* Versions up to 0.3.10 Vulnerable ·vyperlang

Remediation

  • Fix · GHSA-9x7f-gwxq-6f2c vyper (PyPI) Fixed in 0.4.0 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-24561
  2. 2026-10-03 Alias added: GHSA-9x7f-gwxq-6f2c

References

Exploit 1

Advisory 1

Other 4

  • TI-2024-14992 concat built-in can corrupt memory in vyper CVSS 3.1CRITICAL 9.8
  • TI-2024-16184 Vyper array negative index vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-08657 Integer bounds error in Vyper CVSS 3.1CRITICAL 9.8
  • TI-2022-11796 Multiple evaluation of contract address in call in vyper CVSS 3.1HIGH 8.2
  • TI-2024-21531 vyper performs double eval of the argument of sqrt CVSS 3.1MEDIUM 5.3
  • TI-2024-21527 vyper performs incorrect topic logging in raw_log CVSS 3.1MEDIUM 5.3
See all 37 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences