CVE-2026-114114
Description
A flaw was found in Vyper. The compiler improperly calculates source code positions by mixing character-based offsets with byte offsets during parsing. An attacker contributing source code can exploit this flaw by introducing multi-byte characters or invisible markers to shift internal code references. This flaw allows an attacker to silently substitute critical constants, such as addresses and numeric values, in the compiled code, compromising application integrity.
Statement
This vulnerability is rated as having a Moderate impact because successful exploitation requires an attacker to supply maliciously formatted source files that must be processed by the compiler. Vyper is not packaged or distributed within Red Hat Enterprise Linux or core Red Hat product offerings, which limits direct exposure on default installations. In user environments where standalone Vyper tooling is executed, risk is confined to compile-time processing rather than runtime network daemon compromise.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Integrity,Confidentiality
Technical Impact: Other; Varies by Context; Hide Activities
An attacker may ultimately redirect a user to a malicious website, by deceiving the user into believing the URL they are accessing is a trusted domain. However, the attack can also be used to forge log entries by using homoglyphs in usernames. Homoglyph manipulations are often the first step towards executing advanced attacks such as stealing a user's credentials, Cross-Site Scripting (XSS), or log forgery. If an attacker redirects a user to a malicious site, the attacker can mimic a trusted domain to steal account credentials and perform actions on behalf of the user, without the user's knowledge. Similarly, an attacker could create a username for a website that contains homoglyph characters, making it difficult for an admin to review logs and determine which users performed which actions.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
