Key points
- Vyper versions 0.4.0b1 through 0.5.0b1 are affected by CVE-2026-114663.
- The flaw allows attacker-influenced input to replace intended values in contracts.
- The source material does not state whether a fix or patch is available.
Vyper versions 0.4.0b1 through 0.5.0b1 contain a high-severity vulnerability that miscompiles specific code structures. According to the National Vulnerability Database, this flaw affects how the compiler handles unfoldable constants and omitted default arguments from imported modules. Small-business owners using these versions to build smart contracts should verify their software versions immediately, as the source material does not confirm the availability of a fix.
In plain English
The Vyper compiler incorrectly resolves variable names in certain scenarios. When a contract uses a parameter, local variable, or loop variable that shares a name with an imported constant or default argument, the compiler looks for the name in the wrong place. It checks the current function's scope instead of the original declaration. This error causes the compiler to use the wrong value for that variable during execution.
The background
This issue is tracked as CVE-2026-114663 and has a CVSS score of 8.6, which is rated as high. The underlying weakness is classified as CWE-706. The problem occurs because the `parse_Name` function resolves names in the using function's scope rather than at the point of declaration. This technical error creates a pathway for data corruption within the compiled smart contract logic.
What changes now
Attackers can exploit this miscompilation by providing input that influences the shared variable name. This input can replace the intended value with an attacker-controlled one. The source material notes that this includes out-of-range values for narrow types, such as uint8. Such corruption can undermine validation checks or accounting logic within the smart contract, potentially leading to unauthorized actions or financial loss.
Who needs to act first
Teams should prioritize auditing contracts that import modules with default arguments or constants. Check whether any local variables or function parameters share names with those imports. If matches are found, treat those contracts as high risk. Roll out any mitigation by first testing changes in a staging environment. Back up all contract code before making adjustments. Monitor transaction logs for unexpected value changes or failed validations. Reduce exposure by limiting external input on sensitive functions until a vendor fix is available.
What to do and how to stay safe: Vyper
- Audit Vyper codebases for variable name collisions between local scopes and imported modules.
- Monitor deployed contracts for unexpected behavior in validation or accounting logic.
- Restrict external input on functions that use narrow data types like uint8.
- Wait for an official vendor update before deploying patched code to production.
Step-by-step guide: Out-of-Band Patches: Meaning, Risks, and Deployment Reality
General security guidance from the Patch Herald newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which Vyper versions are vulnerable to this issue?
Versions 0.4.0b1 through 0.5.0b1 are affected by this miscompilation flaw.
Is there a patch available for CVE-2026-114663?
The source material does not state whether a fix or patch is available.
How does an attacker exploit this vulnerability?
Attacker-influenced input can replace intended values, including out-of-range values for narrow types.
