CVE-2026-114663 Details

A vulnerability exists in Vyper versions 0.4.0b1 through 0.5.0b1, where the compiler mismanages unfoldable constants and default arguments from imported modules. This issue arises because the name resolution process incorrectly references the using function's scope instead of the original declaration. As a result, if a contract's parameter, local, or loop variable shares a name with an imported constant or default argument, attacker-controlled input can substitute the intended value. This substitution can include out-of-range values for narrow types like uint8, potentially disrupting validation or accounting processes.

To address this vulnerability, Vyper should be updated to maintain the integrity of declaration bindings for constants and default arguments during compilation. Developers can also avoid name collisions by using fully qualified names or by employing literal values instead of constants. For deployed contracts, recompilation and redeployment may be necessary.