CVE-2024-26149 json
Vyper _abi_decode Memory Overflow
published 2024-02-26 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-0180 , GHSA-9p8r-4xp4-gw5w , PYSEC-2024-164
- cvss
- 3.7
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 45%
- public exploits
- 0
- none known
Summary
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within `_abi_decode`. This vulnerability affects 0.3.10 and earlier versions.
Patch / fix
- pypi vyper 0.4.0, 0.4.0b1
- vyperlang vyper 0.4.0
- github.com/vyperlang/vyper#3925 pull request
- github.com/vyperlang/vyper#4060 pull request
- github.com/vyperlang/vyper#4091 pull request
- github.com/vyperlang/vyper#4144 pull request
- github.com/vyperlang/vyper/security/advisories/GHSA-9p8r-4xp4-gw5w advisory
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.54% chance of exploitation in the next 30 days, higher than 45% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- github.com https://github.com/vyperlang/vyper/security/advisories/GHSA-9p8r-4xp4-gw5w referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| OSV | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | vyper | <0.4.0 <0.4.0b1 |
0.4.0 0.4.0b1 |
Affected products
- vyperlang vyper
Classification
References
-
github.com
/vyperlang/vyper/security/advisories/GHSA-9p8r-4xp4-gw5w
web, exploit, patch, vendor-advisory, advisory, evidence
-
github.com
/vyperlang/vyper/pull/3925
web
-
github.com
/vyperlang/vyper/pull/4060
web
-
github.com
/vyperlang/vyper/pull/4091
web
-
github.com
/vyperlang/vyper/pull/4144
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-26149
advisory
-
github.com
/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-164.yaml
web
-
github.com
/vyperlang/vyper
package
-
github.com
/advisories/GHSA-9p8r-4xp4-gw5w
advisory
Sources
- CVE List CVE-2024-26149
- GitHub Advisory GHSA-9p8r-4xp4-gw5w
- NVD CVE-2024-26149
- OSV PYSEC-2024-164
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.