# CVE-2026-114114: Vyper source literal value substitution via multi-byte characters

Source: https://junglewise.ai/threats/cve-2026-114114-vyper-0-1-0b1-before-0-1-0b12-0-1-0b14-and-0-4-1-through-0-5-0b1  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114114 · Severity: medium · CVSS 5.3 · Published 2026-10-21

Vyper is a smart contract programming language for Ethereum. Due to mishandled Unicode encoding, an attacker can craft source code with hidden multi-byte characters that cause numeric constants (addresses, amounts, selectors) to be silently substituted during compilation. This could result in a compiled contract containing unintended values without any compiler warning, potentially allowing theft or redirection of funds.

Technologies: [Vyper](https://junglewise.ai/threats/technologies/vyper-vyper). Vendors: [Vyper](https://junglewise.ai/threats/vendors/vyper).

## Quick answers

**Is CVE-2026-114114 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114114 being exploited in the wild.

**How severe is CVE-2026-114114?** Medium severity, with a CVSS score of 5.3, published 21 October 2026.

**Which products and versions are affected?** Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, 0.4.1 through 0.5.0b1.

**Is there a fix for CVE-2026-114114?** Yes: fixed in Vyper 0.1.0b12, 0.1.0b15, 0.4.0 (unaffected); patched versions after 0.5.0b1. Until then: Until upgraded, reject non-ASCII characters outside comments and docstrings, including byte-order marks, during source review or via a linter/pre-processor. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-114114 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114114?** Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Vyper 0.1.0b12, 0.1.0b15, 0.4.0 (unaffected); patched versions after 0.5.0b1

Until upgraded, reject non-ASCII characters outside comments and docstrings, including byte-order marks, during source review or via a linter/pre-processor.

## Technical details

In vyper/ast/parse.py, the parser mixes character-based line offsets with Python's UTF-8 byte col_offset values. Multi-byte UTF-8 characters (such as non-ASCII identifiers that NFKC-normalize to ASCII, or an invisible byte-order mark) shift the source slice boundaries used to extract later numeric literals on the same line. An attacker can position a replacement value where the shifted slice lands, changing addresses, integers, or other constants without triggering a compiler warning. This affects versions where character offsets are converted to byte offsets, or where a line table was introduced.

## Affected products

- Vyper Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, 0.4.1 through 0.5.0b1

## Timeline

- 2026-10-06: disclosed
- 2026-10-21: advisory

## References

- [https://github.com/vyperlang/vyper/security/advisories/GHSA-r3c7-7xwm-6vfw](https://github.com/vyperlang/vyper/security/advisories/GHSA-r3c7-7xwm-6vfw)
- [https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-substitution-via-multi-byte-characters](https://www.vulncheck.com/advisories/vyper-through-0.5-0b1-literal-value-substitution-via-multi-byte-characters)

## Related threats

- [Vyper name resolution scope vulnerability in constants and defaults](https://junglewise.ai/threats/cve-2026-114663-vyper-0-4-0b1-through-0-5-0b1-miscompiles-unfoldable-constants)
- [Vyper create_from_blueprint offset validation bypass via unsigned wraparound](https://junglewise.ai/threats/cve-2026-114118-vyper-0-3-4-through-0-5-0b1-computes-the-remaining-blueprint)
- [Vyper optimizer miscompilation in ternary expressions](https://junglewise.ai/threats/cve-2026-114117-vyper-0-3-8-through-0-5-0b1-contains-an-optimizer-miscompilation)
- [Vyper source-line table parsing allows numeric literal value manipulation](https://junglewise.ai/threats/cve-2026-114116-vyper-0-1-0b1-before-0-1-0b17-and-0-4-1-through-0-5-0b1-builds)
- [Vyper memory corruption in internal function calls within arrays](https://junglewise.ai/threats/cve-2021-48020-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption)