Is CVE-2026-114114 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-114114 being exploited in the wild.

How severe is CVE-2026-114114?

Medium severity, with a CVSS score of 5.3, published 21 October 2026.

Which products and versions are affected?

Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, 0.4.1 through 0.5.0b1.

How is CVE-2026-114114 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-114114?

Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-114114: Vyper source literal value substitution via multi-byte characters

CVE-2026-114114 · Severity: medium · CVSS 5.3 · Published 2026-10-21

Vyper is a smart contract programming language for Ethereum. Due to mishandled Unicode encoding, an attacker can craft source code with hidden multi-byte characters that cause numeric constants (addresses, amounts, selectors) to be silently substituted during compilation. This could result in a compiled contract containing unintended values without any compiler warning, potentially allowing theft or redirection of funds.

Technologies: Vyper. Vendors: Vyper.

Quick answers

Is CVE-2026-114114 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-114114 being exploited in the wild.
How severe is CVE-2026-114114?: Medium severity, with a CVSS score of 5.3, published 21 October 2026.
Which products and versions are affected?: Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, 0.4.1 through 0.5.0b1.
Is there a fix for CVE-2026-114114?: Yes: fixed in Vyper 0.1.0b12, 0.1.0b15, 0.4.0 (unaffected); patched versions after 0.5.0b1. Until then: Until upgraded, reject non-ASCII characters outside comments and docstrings, including byte-order marks, during source review or via a linter/pre-processor. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-114114 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-114114?: Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: Vyper 0.1.0b12, 0.1.0b15, 0.4.0 (unaffected); patched versions after 0.5.0b1

Until upgraded, reject non-ASCII characters outside comments and docstrings, including byte-order marks, during source review or via a linter/pre-processor.

Technical details

In vyper/ast/parse.py, the parser mixes character-based line offsets with Python's UTF-8 byte col_offset values. Multi-byte UTF-8 characters (such as non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark) shift the source slice boundaries used to extract later numeric literals on the same line. An attacker can position a replacement value where the shifted slice lands, changing addresses, integers, or other constants without triggering a compiler warning. This affects versions where character offsets are converted to byte offsets, or where a line table was introduced.

Affected products

Vyper Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, 0.4.1 through 0.5.0b1

Timeline

2026-10-06: disclosed
2026-10-21: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.