{"id":"CVE-2026-114118","summary":"Vyper 0.3.4 through 0.5.0b1 create_from_blueprint Offset Validation Bypass via Unsigned Wraparound","details":"Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtraction without first checking that code_offset is below the blueprint's code size, so a huge offset wraps to a small positive value. An attacker controlling code_offset can make a factory deploy contracts with no runtime code, potentially trapping ETH and tokens.","aliases":["GHSA-fxg7-4wqg-c8gh"],"modified":"2026-10-21T10:45:45.858181898Z","published":"2026-10-21T00:37:15.454Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114118.json","cna_assigner":"VulnCheck","cwe_ids":["CWE-681"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/114xxx/CVE-2026-114118.json"},{"type":"ADVISORY","url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-fxg7-4wqg-c8gh"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114118"},{"type":"ADVISORY","url":"https://www.vulncheck.com/advisories/vyper-0.3.4-through-0.5-0b1-create-from-blueprint-offset-validation-bypass-via-unsigned-wraparound"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/vyperlang/vyper","events":[{"introduced":"f31f0ec406bbbd2055f125abd17278e3ac2ed84f"},{"last_affected":"577d2534356903076bb79b5b15ebd4d772994693"}],"database_specific":{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"0.3.4"},{"last_affected":"0.5.0b1"}],"source":"AFFECTED_FIELD"}]}}],"versions":["v0.5.0b1","v0.5.0a3","v0.5.0a2","v0.5.0a1","v0.4.3","v0.4.3rc1","v0.4.2","v0.4.2rc1","v0.4.1","v0.4.1rc3","v0.4.1rc2","v0.4.1rc1","v0.4.1b4","v0.4.1b3","v0.4.1b2","v0.4.1b1","v0.4.0","v0.4.0rc6","v0.4.0rc5","v0.4.0rc4","v0.4.0rc3","v0.4.0rc2","v0.4.0rc1","v0.4.0b6","v0.4.0b5","v0.4.0b4","v0.4.0b3","v0.4.0b2","v0.4.0b1","v0.3.10","v0.3.10rc5","v0.3.10rc4","v0.3.10rc3","v0.3.10rc2","v0.3.10rc1","v0.3.9","v0.3.8","v0.3.7","v0.3.6","v0.3.5","v0.3.4"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-114118.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N"}]}