CVE-2026-114117 Details
Description
Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | K), where K is any nonzero integer literal, is compiled to the constant 1 when used as a ternary expression branch under -O gas (the default) or -O codesize. Affected contracts use the wrong value in storage writes, arithmetic, indexes, return values, or events without warning or revert, which can record deposits incorrectly and lock funds.
A vulnerability exists in Vyper versions 0.3.8 through 0.5.0b1 due to an optimizer miscompilation. When '(msg.value | K)' or '(len(msg.data) | K)' is used as a branch in a ternary expression under the default optimization for gas or codesize, it incorrectly compiles to the constant '1', regardless of the actual value. This miscompilation leads to the wrong values being used in storage writes, arithmetic operations, array indexes, return values, and event fields, without any warning or revert. As a result, contracts can misrecord deposits, causing funds to be locked and unavailable for withdrawal.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/vyperlang/vyper/security/advisories/GHSA-6j9c-gvcw-74fj | CISA-ADP | AdvisoryExploitVendor |
| https://github.com/vyperlang/vyper/security/advisories/GHSA-6j9c-gvcw-74fj | [email protected] | AdvisoryExploitVendor |
| https://www.vulncheck.com/advisories/vyper-0.3.8-through-0.5-0b1-optimizer-miscompilation-of-msg-value-k-in-ternary-branches | [email protected] | Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-682 | Incorrect Calculation | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vyper | >= 0.3.8, <= 0.5.0b1 |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 21, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |