Vulnerability · Published Feb 26, 2024 · Assigned by GitHub_M

CVE-2024-26149Vyper _abi_decode Memory Overflow

Low 3.7

In plain English

A low-severity memory corruption in vyper from vyperlang. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)3.7Low

Exploit odds (30 days)0.5%top 54.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within `_abi_decode`. This vulnerability affects 0.3.10 and earlier versions.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	vyper	0.4.0	GHSA-9p8r-4xp4-gw5w
PyPI	vyper	0.4.0b1	PYSEC-2024-164

Affected products (as reported)

Vendor	Product	Versions
vyperlang	vyper	<= 0.3.10

Weakness: CWE-119 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://github.com/vyperlang/vyper/security/advisories/GHSA-9p8r-4xp4-gw5w x_refsource_CONFIRM