Read the docs
TI-2026-78727 Aliases CVE-2026-114114

Vyper multi-byte characters let attackers substitute literals

Priority MEDIUM 60CWE-176Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Vyper from 0.1.0b1 before 0.1.0b12, from 0.1.0b14 before 0.1.0b15, and from 0.4.1 through 0.5.0b1 is affected. The parser in vyper/ast/parse.py mixes character-based line offsets with UTF-8 byte offsets (CWE-176), which shifts the source slices used to rebuild numeric literals. An attacker who contributes source with non-ASCII identifiers or an invisible byte-order mark can silently cause compiled code to substitute addresses, integers or other constants when a user compiles it.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.0026 17th percentileScored 2026-11-07
Fix Fixed vyper (vyperlang): 0.1.0b12, 0.1.0b15

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
vyperlangvyper0.1.0b1 to before 0.1.0b120.1.0b12Patch availableCNA
vyperlangvyper0.1.0b14 to before 0.1.0b150.1.0b15Patch availableCNA
vyperlangvyper0.4.1 – 0.5.0b1—No fix listedCNA
  • vyper Vendorvyperlang Affected 0.1.0b1 to before 0.1.0b12 Fixed in 0.1.0b12 Patch available CNA
  • vyper Vendorvyperlang Affected 0.1.0b14 to before 0.1.0b15 Fixed in 0.1.0b15 Patch available CNA
  • vyper Vendorvyperlang Affected 0.4.1 – 0.5.0b1 Fixed in — No fix listed CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*——vyperlang
  • cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:* Versions — — ·vyperlang

Remediation

Upgrade to Vyper 0.1.0b12 for the first affected range and to 0.1.0b15 for the second. No fixed version is listed for 0.4.1 through 0.5.0b1.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA vyper (vyperlang) Fixed in 0.1.0b12
  • Fix · CNA vyper (vyperlang) Fixed in 0.1.0b15

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114114
  2. 2026-10-21 Affected versions changed · Red Hat
  3. 2026-10-21 CVSS score added · Red Hat
  4. 2026-10-22 Priority changed: MEDIUM → LOW
  5. 2026-10-28 CISA SSVC decision points changed
  6. 2026-10-28 Priority changed: LOW → MEDIUM

References

Advisory 1

  • TI-2024-16182 Vyper bounds check on built-in `slice()` function can be overflowed CVSS 3.1CRITICAL 9.8
  • TI-2024-14992 concat built-in can corrupt memory in vyper CVSS 3.1CRITICAL 9.8
  • TI-2024-16184 Vyper array negative index vulnerability CVSS 3.1CRITICAL 9.8
  • TI-2022-08657 Integer bounds error in Vyper CVSS 3.1CRITICAL 9.8
  • TI-2022-11796 Multiple evaluation of contract address in call in vyper CVSS 3.1HIGH 8.2
  • TI-2026-78730 Optimizer miscompilation of msg.value | K in Vyper ternary branches CVSS 4.0HIGH 8.2
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences