CVE-2026-114116: Interpretation Conflict in vyperlang vyper

The vulnerability in vyperlang's vyper arises because versions 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 use str.splitlines() to build the source-line table. This method treats characters such as form feed and U+2028 as line breaks, whereas the Python parser does not. As a result, numeric literals are classified and validated based on shifted source text. An attacker who can contribute source code can exploit this by embedding these special characters in comments, strings, or indentation, causing silent changes to address, integer, or decimal constants.

This vulnerability can lead to silent modification of numeric literals in the source code, potentially causing incorrect interpretation of addresses or numeric constants. This could affect the correctness and security of smart contracts compiled with affected vyper versions. The CVSS 4.0 score of 6 indicates a medium severity with network attack vector, low attack complexity, partial attack prerequisites, no privileges required, user interaction required, no confidentiality or availability impact, but high integrity impact.

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid using affected versions or carefully review source code for suspicious hidden characters in comments, strings, or indentation that could alter numeric literals.