# CVE-2025-47774: PYSEC-2026-2028 - Vyper's `slice()` may elide side-effects when output length is 0

Source: https://junglewise.ai/threats/cve-2025-47774-vyper-s-slice-may-elide-side-effects-when-output-length-is-0  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-07  
License: CC BY 4.0 with a link back

CVE-2025-47774 · Severity: medium · CVSS 4 · Published 2026-07-07

Vyper's `slice()` may elide side-effects when output length is 0

Technologies: [vyper (PyPI)](https://junglewise.ai/threats/technologies/vyper). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2025-47774 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-47774 being exploited in the wild.

**How severe is CVE-2025-47774?** Medium severity, with a CVSS score of 4, published 7 July 2026.

**Which products and versions are affected?** vyper (PyPI) ECOSYSTEM:introduced=0,last_affected=0.4.2rc1.

**Is there a fix for CVE-2025-47774?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**Am I affected by CVE-2025-47774?** Check whether you run vyper (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Affected products

- vyper (PyPI) ECOSYSTEM:introduced=0,last_affected=0.4.2rc1

## Identifiers

- CVE-2025-47774
- GHSA-3vcg-j39x-cwfm
- PYSEC-2026-2028

## Related threats

- [Vyper memory corruption in nested function calls and tuples](https://junglewise.ai/threats/vyper-memory-corruption-using-function-calls-within-tuples-nested-calls-c0689acb)
- [Vyper stack corruption in complex type argument passing](https://junglewise.ai/threats/vyper-call-stack-corruption-when-passing-complex-type-containing-non-3deb0c30)
- [Vyper return statement in nested for loops causes revert](https://junglewise.ai/threats/vyper-return-inside-for-loop-more-than-1-level-deep-ee8a193d)
- [PYSEC-2026-2029 - Vyper's `concat()` builtin may elide side-effects for zero-length arguments](https://junglewise.ai/threats/cve-2025-47285-vyper-s-concat-builtin-may-elide-side-effects-for-zero-length)
- [AugAssign evaluation order causing OOB write within the object in Vyper](https://junglewise.ai/threats/cve-2025-27105-augassign-evaluation-order-causing-oob-write-within-the-object-in)