{"id":"CVE-2026-114115","kind":"vulnerability","aliases":["CVE-2026-114115"],"related":[],"title":"Vyper: compiler miscompiles ternary over nested arrays, corrupting stored values","description":"Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested arrays with narrower inner bounds using the wider result type's memory layout. When a ternary selects the narrower array, inner arrays after the first are read at wrong offsets, causing contracts to silently store corrupted values or revert.","summary":"Vyper versions 0.3.8 through 0.5.0b1 compile a ternary expression that selects a nested array with narrower inner bounds using the wider type's memory layout. Contracts compiled this way can silently store corrupted values or revert.","severity":"medium","cvss":6.3,"epss":0.00221,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["ethereum","package","smart-contracts","vyper"],"not_affected_if":["default-config"],"how_to_check":"- Check the Vyper compiler version used to build contracts, for example with `vyper --version`, and see whether it falls in `0.3.8` through `0.5.0b1`.\n- Search Vyper source for ternary (`if ... else`) expressions that select between nested array types of different inner lengths.","fix":"- Upgrade the Vyper compiler to a release after `0.5.0b1`, then recompile and redeploy affected contracts.\n- unknown: the sources do not name the first fixed version.","status":"open","published_at":"2026-10-21T01:17:37+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T04:01:23+00:00","updated_at":"2026-10-25T04:01:23+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-25T04:01:23Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the Vyper compiler to a release after `0.5.0b1`, then recompile and redeploy affected contracts.\n- unknown: the sources do not name the first fixed version.","reach":"unknown","title":"Vyper: compiler miscompiles ternary over nested arrays, corrupting stored values","impact":"medium","summary":"Vyper versions 0.3.8 through 0.5.0b1 compile a ternary expression that selects a nested array with narrower inner bounds using the wider type's memory layout. Contracts compiled this way can silently store corrupted values or revert.","category":"package","nicknames":[],"who_cares":["vyper","smart-contracts","ethereum"],"confidence":0.6,"needs_auth":"unknown","worst_case":"Contract stores corrupted values silently, or reverts unexpectedly.","analyst_note":"Confirm the first fixed Vyper version and whether deployed contracts are at risk, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-114115.","how_to_check":"- Check the Vyper compiler version used to build contracts, for example with `vyper --version`, and see whether it falls in `0.3.8` through `0.5.0b1`.\n- Search Vyper source for ternary (`if ... else`) expressions that select between nested array types of different inner lengths.","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Teams that compile Vyper contracts with a compiler in the affected range and whose code uses a conditional expression that picks between nested arrays of different inner sizes. Contracts that do not use that pattern, or that were built with a compiler outside the range, are not affected by this report.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000652,"input_tokens":3397,"output_tokens":625,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-114115':13A,16A '-2026':12A,15A '0.3.8':25B,61C '0.5.0':27B,63C 'array':7A,37B,76C,95C,97C 'b1':28B,64C 'bound':41B,80C 'caus':106C 'compil':2A,29B,50B,67C 'contain':65C 'contract':21B,49B,107C 'corrupt':8A,56B,111C 'cve':11A,14A 'ethereum':17B 'express':32B 'first':100C 'ifexp':72C 'inner':40B,79C,96C 'layout':48B,88C 'memori':47B,87C 'miscompil':3A,68C 'narrow':39B,78C,94C 'nest':6A,36B,75C 'offset':105C 'packag':18B 'pars':71C 'read':74C,102C 'result':84C 'revert':59B,114C 'select':34B,92C 'silent':54B,109C 'smart':20B 'smart-contract':19B 'store':9A,55B,110C 'ternari':4A,31B,91C 'type':45B,85C 'use':42B,81C 'valu':10A,57B,112C 'version':24B 'vulner':69C 'vyper':1A,22B,23B,60C 'way':52B 'wider':44B,83C 'wrong':104C","nicknames":[],"mitigations":[],"who_affected":"Teams that compile Vyper contracts with a compiler in the affected range and whose code uses a conditional expression that picks between nested arrays of different inner sizes. Contracts that do not use that pattern, or that were built with a compiler outside the range, are not affected by this report.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T01:17:37+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-114115","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-114115","severity":null,"published_at":"2026-10-21T01:17:37+00:00","modified_at":"2026-10-22T17:39:56+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-114115","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-114115","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:54+00:00","fetched_at":"2026-10-24T13:15:54+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}