Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code.
Metrics
Affected Vendors & Products
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Wed, 21 Oct 2026 00:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code. | |
| Title | Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters | |
| First Time appeared |
Vyperlang
Vyperlang vyper |
|
| Weaknesses | CWE-176 | |
| CPEs | cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:* | |
| Vendors & Products |
Vyperlang
Vyperlang vyper |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: VulnCheck
Published:
Updated: 2026-10-21T00:37:12.518Z
Reserved: 2026-10-20T21:48:58.503Z
Link: CVE-2026-114114
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-10-21T01:17:37.640
Modified: 2026-10-21T01:17:37.640
Link: CVE-2026-114114
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses