CVE-2026-114663
Description
A flaw was found in Vyper. The compiler incorrectly resolves imported constants and default arguments within a function's local scope rather than at their original declaration. If a smart contract uses a local variable or parameter that shares a name with an imported identifier, an attacker interacting with the contract can override intended constant values with arbitrary input. This issue can lead to bypassed security validation and corrupted accounting logic in affected smart contracts.
Statement
This vulnerability is rated as Important rather than Critical because exploitation is limited to contract builds where function-scoped parameters directly collide with imported identifiers, requiring specific code patterns to manifest. In Red Hat environments, the Vyper compiler is not included or supported in Red Hat Enterprise Linux releases and is only available through community Fedora repositories. For systems utilizing the compiler locally, the miscompilation can lead to high integrity and availability compromises in deployed contracts by allowing unexpected input to bypass internal safeguards.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
