CVE-2026-114118 Details

A vulnerability exists in Vyper versions 0.3.4 through 0.5.0b1 within the 'create_from_blueprint' function. The issue arises because the function calculates the remaining blueprint size using unsigned integer subtraction without first verifying that the 'code_offset' is less than the blueprint's total code size. This oversight allows a large offset to wrap around and result in a small positive value. An attacker who manipulates the 'code_offset' can exploit this flaw, causing a factory to deploy contracts that lack runtime code, which could lead to the loss of ETH and tokens.

Users can validate that 'code_offset' is less than 'extcodesize(target)' using an unsigned comparison before performing the subtraction. As a workaround, a fixed, valid offset can be used, or this bound can be explicitly enforced before calling 'create_from_blueprint'.