{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-114114", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-10-20T21:48:58.503Z", "datePublished": "2026-10-21T00:37:12.518Z", "dateUpdated": "2026-10-21T00:37:12.518Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-10-21T00:37:12.518Z"}, "datePublic": "2026-10-06T00:00:00.000Z", "title": "Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters", "descriptions": [{"lang": "en", "value": "Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Handling of Unicode Encoding", "cweId": "CWE-176", "type": "CWE"}]}], "affected": [{"vendor": "vyperlang", "product": "vyper", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/vyper", "versions": [{"version": "0.1.0b1", "status": "affected", "versionType": "python", "lessThan": "0.1.0b12"}, {"version": "0.1.0b12", "status": "unaffected", "versionType": "python"}]}, {"vendor": "vyperlang", "product": "vyper", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/vyper", "versions": [{"version": "0.1.0b14", "status": "affected", "versionType": "python", "lessThan": "0.1.0b15"}, {"version": "0.1.0b15", "status": "unaffected", "versionType": "python"}]}, {"vendor": "vyperlang", "product": "vyper", "defaultStatus": "unaffected", "packageURL": "pkg:pypi/vyper", "versions": [{"version": "0.4.1", "status": "affected", "versionType": "python", "lessThanOrEqual": "0.5.0b1"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.1.0b1", "versionEndExcluding": "0.1.0b12"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.1.0b14", "versionEndExcluding": "0.1.0b15"}]}]}, {"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:vyperlang:vyper:*:*:*:*:*:*:*:*", "versionStartIncluding": "0.4.1", "versionEndIncluding": "0.5.0b1"}]}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "baseScore": 6, "baseSeverity": "MEDIUM", "exploitMaturity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS"}, {"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS"}], "references": [{"url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-r3c7-7xwm-6vfw", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-r3c7-7xwm-6vfw)"}, {"name": "VulnCheck Advisory: Vyper through 0.5.0b1 Literal Value Substitution via Multi-byte Characters", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-substitution-via-multi-byte-characters"}], "credits": [{"lang": "en", "value": "hyeon-Sec", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:pypi/vyper", "product": "vyper", "vendor": "vyperlang", "versions": [{"lessThan": "0.1.0b12", "status": "affected", "version": "0.1.0b1", "versionType": "python"}, {"status": "unaffected", "version": "0.1.0b12", "versionType": "python"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:pypi/vyper", "product": "vyper", "vendor": "vyperlang", "versions": [{"lessThan": "0.1.0b15", "status": "affected", "version": "0.1.0b14", "versionType": "python"}, {"status": "unaffected", "version": "0.1.0b15", "versionType": "python"}]}, {"defaultStatus": "unaffected", "packageURL": "pkg:pypi/vyper", "product": "vyper", "vendor": "vyperlang", "versions": [{"lessThanOrEqual": "0.5.0b1", "status": "affected", "version": "0.4.1", "versionType": "python"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code."}], "id": "CVE-2026-114114", "lastModified": "2026-10-22T17:00:33.203", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.0, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}]}, "published": "2026-10-21T01:17:37.640", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/vyperlang/vyper/security/advisories/GHSA-r3c7-7xwm-6vfw"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-substitution-via-multi-byte-characters"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-176"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{"bugzilla": {"description": "vyper: Vyper: Silent constant substitution in compiled code via multi-byte character parsing", "id": "2558035", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2558035"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "status": "draft"}, "cwe": "CWE-1007", "details": ["Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Python's UTF-8 byte col_offset values in vyper/ast/parse.py, so multi-byte characters shift the source slices used to reconstruct later numeric literals. An attacker contributing source with non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark, can silently substitute addresses, integers or other constants in compiled code.", "A flaw was found in Vyper. The compiler improperly calculates source code positions by mixing character-based offsets with byte offsets during parsing. An attacker contributing source code can exploit this flaw by introducing multi-byte characters or invisible markers to shift internal code references. This flaw allows an attacker to silently substitute critical constants, such as addresses and numeric values, in the compiled code, compromising application integrity."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-114114", "public_date": "2026-10-21T00:37:12Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-114114\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-114114\nhttps://github.com/vyperlang/vyper/security/advisories/GHSA-r3c7-7xwm-6vfw\nhttps://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-substitution-via-multi-byte-characters"], "statement": "This vulnerability is rated as having a Moderate impact because successful exploitation requires an attacker to supply maliciously formatted source files that must be processed by the compiler. Vyper is not packaged or distributed within Red Hat Enterprise Linux or core Red Hat product offerings, which limits direct exposure on default installations. In user environments where standalone Vyper tooling is executed, risk is confined to compile-time processing rather than runtime network daemon compromise.", "threat_severity": "Moderate"}