CVE-2026-114663: Use of Incorrectly-Resolved Name or Reference in vyperlang vyper
Description
Vyper versions 0.4.0b1 through 0.5.0b1 contain a vulnerability where the compiler miscompiles unfoldable constants and omits default arguments from imported modules. This occurs because the parse_Name function resolves names in the scope of the using function rather than at their declaration. If a contract's parameter, local, or loop variable shares such a name, attacker-controlled input can replace the intended value, including out-of-range values for narrow types like uint8, potentially corrupting validation or accounting logic.
CVSS v4.0
Score 8.6high
Affected software
vyperlang
vyper
pkg:github/vyperlang/vyperRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability in Vyper 0.4.0b1 through 0.5.0b1 arises from incorrect name resolution during compilation. Specifically, parse_Name resolves names in the scope of the using function rather than at the point of declaration, leading to miscompilation of unfoldable constants and omission of default arguments from imported modules. This flaw allows attacker-influenced inputs to override intended values when contract parameters, locals, or loop variables share the same name, including injection of out-of-range values for narrow types such as uint8. The result can be corruption of validation or accounting logic within smart contracts.
Potential Impact
An attacker can manipulate contract parameters or variables by exploiting the incorrect name resolution, potentially injecting out-of-range values that corrupt validation or accounting logic. This can lead to incorrect contract behavior, undermining the integrity of smart contract operations.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- VulnCheck
- Date Reserved
- 2026-10-21T21:59:05.257Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6ad96eff4d27ba8daa1d22fd
Added to database: 10/22/2026, 02:03:43 UTC
Last enriched: 10/22/2026, 02:15:20 UTC
Last updated: 10/22/2026, 02:18:51 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.