CVE-2022-24788 Buffer overflow in Vyper

High 7.1 Published 13 Apr 2022 Updated 23 Apr 2025

A buffer overflow in the Vyper compiler allows attackers to cause crashes or execute arbitrary code via malicious JSON interface imports.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: A user has to click or open something
Fix: Available

What is CVE-2022-24788?

CVE-2022-24788 is a high-severity memory corruption vulnerability in vyperlang vyper, published on 13 Apr 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. Versions of vyper prior to 0.3.2 suffer from a potential buffer overrun. Importing a function from a JSON interface which returns `bytes` generates bytecode which does not clamp bytes length, potentially resulting in a buffer overrun. Users are advised to upgrade. There are no known workarounds for this issue.

Weakness: CWE-119, CWE-120

Which versions are affected by CVE-2022-24788?

3 open source packages ship an affected version, including vyper. It affects 1 product.

Package	Affected	Fixed in
`vyper` PyPI	All versions	`0.3.2`
`vyper` PyPI	All versions	`0.3.2`
`vyper` PyPI	All versions	`0.3.2`

Products include Vyperlang Vyper.

How do I fix CVE-2022-24788?

Upgrade vyper to 0.3.2 or later.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2022-24788 being exploited?

There is no known exploitation of CVE-2022-24788 in the wild and no public exploit code.

Sources

Also known as GHSA-4mrx-6fxm-8jpg, PYSEC-2022-197.