CVE-2026-114118 Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound

Medium 6.3 Published 21 Oct 2026 Updated 27 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-114118?

CVE-2026-114118 is a medium-severity vulnerability in vyperlang vyper, published on 21 Oct 2026.

Official description

Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens.

Weakness: CWE-681

Which versions are affected by CVE-2026-114118?

How do I fix CVE-2026-114118?

No fix has been published for CVE-2026-114118 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-114118 being exploited?

There is no known exploitation of CVE-2026-114118 in the wild and no public exploit code.

Sources

Also known as GHSA-fxg7-4wqg-c8gh, GHSA-p4mc-qjvf-mf2m.