What’s Vulnerable › Vulnerabilities

CVE-2026-114118: Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-10-21 · updated 2026-10-27
• Weakness: CWE-681

Description

Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens.

Affected products

• vyperlang vyper: from 0.3.4 through 0.5.0b1

References

• https://github.com/vyperlang/vyper/security/advisories/GHSA-fxg7-4wqg-c8gh
• https://www.vulncheck.com/advisories/vyper-0.3.4-through-0.5-0b1-create-from-blueprint-offset-validation-bypass-via-unsigned-wraparound

Get alerted when CVE-2026-114118 or the next vulnerability affects your stack