CVE-2026-114118
Description
A flaw was found in Vyper. When deploying smart contracts from blueprints (reusable contract templates), the create_from_blueprint function calculates remaining code size without verifying that the offset is within the template boundaries, causing an integer calculation error. A remote attacker controlling the offset parameter can exploit this vulnerability to deploy contracts without executable runtime code, potentially locking Ether (ETH) and tokens permanently.
Statement
This vulnerability is rated as Moderate impact because successful exploitation requires specific conditions where external actors can supply arbitrary offset parameters during blueprint deployment, limiting the blast radius to vulnerable factory patterns. Vyper is not distributed with Red Hat Enterprise Linux or other supported Red Hat software, meaning default enterprise deployments do not expose this functionality.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
