# CVE-2026-114117: Vyper optimizer miscompilation in ternary expressions

Source: https://junglewise.ai/threats/cve-2026-114117-vyper-0-3-8-through-0-5-0b1-contains-an-optimizer-miscompilation  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114117 · Severity: medium · CVSS 5.9 · Published 2026-10-21

Vyper, a compiler for smart contracts, contains a bug in its default code optimizer that replaces expressions like (msg.value | K) with the constant value 1 when used in conditional branches. This causes smart contracts to record transaction values incorrectly—for example, deposits might be recorded as 1 wei instead of the actual amount sent—leaving funds permanently locked in the contract.

Technologies: [Vyper](https://junglewise.ai/threats/technologies/vyper-vyper). Vendors: [Vyper](https://junglewise.ai/threats/vendors/vyper).

## Quick answers

**Is CVE-2026-114117 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114117 being exploited in the wild.

**How severe is CVE-2026-114117?** Medium severity, with a CVSS score of 5.9, published 21 October 2026.

**Which products and versions are affected?** Vyper 0.3.8 through 0.5.0b1.

**Is there a fix for CVE-2026-114117?** No fixed version is recorded yet. Compile affected contracts with the -O none flag to disable optimization, or avoid using bitwise-or expressions with integer literals in ternary branches until a patch is released. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-114117 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114117?** Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Compile affected contracts with the -O none flag to disable optimization, or avoid using bitwise-or expressions with integer literals in ternary branches until a patch is released.

## Technical details

The optimizer in vyper/ir/optimizer.py incorrectly rewrites (or x K) to 1 for expressions in ternary branches, treating both value branches as if they were conditions. The bug affects msg.value and len(msg.data) with any nonzero integer literal K when the -O gas or -O codesize optimization flags are used (default is -O gas). Exploitation requires deploying a vulnerable contract; the miscompiled code runs without warning or revert, causing logic errors in storage writes, array indexing, and return values.

## Affected products

- Vyper Vyper 0.3.8 through 0.5.0b1

## Timeline

- 2026-10-02: disclosed
- 2026-10-20: advisory

## References

- [https://github.com/vyperlang/vyper/security/advisories/GHSA-6j9c-gvcw-74fj](https://github.com/vyperlang/vyper/security/advisories/GHSA-6j9c-gvcw-74fj)
- [https://www.vulncheck.com/advisories/vyper-0.3.8-through-0.5-0b1-optimizer-miscompilation-of-msg-value-k-in-ternary-branches](https://www.vulncheck.com/advisories/vyper-0.3.8-through-0.5-0b1-optimizer-miscompilation-of-msg-value-k-in-ternary-branches)

## Related threats

- [Vyper name resolution scope vulnerability in constants and defaults](https://junglewise.ai/threats/cve-2026-114663-vyper-0-4-0b1-through-0-5-0b1-miscompiles-unfoldable-constants)
- [Vyper create_from_blueprint offset validation bypass via unsigned wraparound](https://junglewise.ai/threats/cve-2026-114118-vyper-0-3-4-through-0-5-0b1-computes-the-remaining-blueprint)
- [Vyper source-line table parsing allows numeric literal value manipulation](https://junglewise.ai/threats/cve-2026-114116-vyper-0-1-0b1-before-0-1-0b17-and-0-4-1-through-0-5-0b1-builds)
- [Vyper source literal value substitution via multi-byte characters](https://junglewise.ai/threats/cve-2026-114114-vyper-0-1-0b1-before-0-1-0b12-0-1-0b14-and-0-4-1-through-0-5-0b1)
- [Vyper memory corruption in internal function calls within arrays](https://junglewise.ai/threats/cve-2021-48020-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption)