Vyper: Compiler logic error in constant and argument resolution (CVE-2026-114663)
Vyper versions 0.4.0b1 through 0.5.0b1 miscompile unfoldable constants and omitted default arguments from imported modules, potentially allowing attacker-influenced input to corrupt validation or accounting logic.
CVE search metadata
CVE search record: CVE-2026-114663. Severity: high. CVSS: 8.4. KEV: no. Product: Vyper (0.4.0b1 through 0.5.0b1). Brief: Vyper: Compiler logic error in constant and argument resolution (CVE-2026-114663). Brief link: https://feed.craftedsignal.io/briefs/2026-10-vyper-compiler-vulnerability/
Triage facts
Revision 1- Applicability
- Vyper (0.4.0b1 through 0.5.0b1)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 22, 03:53 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Vyper versions 0.4.0b1 through 0.5.0b1 contain a compiler flaw where unfoldable constants and omitted default arguments from imported modules are resolved in the function's scope rather than at declaration. This occurs because 'parse_Name' incorrectly resolves these names. When a contract parameter, local, or loop variable shares a name with such an imported constant or default argument, attacker-influenced input can replace the intended value. This may include out-of-range values for narrow types (e.g., uint8), resulting in corrupted validation or accounting logic. The CVSS v3.1 base score is 8.4.