# CVE-2026-114118: Vyper create_from_blueprint offset validation bypass via unsigned wraparound

Source: https://junglewise.ai/threats/cve-2026-114118-vyper-0-3-4-through-0-5-0b1-computes-the-remaining-blueprint  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2026-114118 · Severity: medium · CVSS 4.8 · Published 2026-10-21

Vyper is a programming language for writing smart contracts on blockchain networks. The create_from_blueprint function, which deploys contract instances from a template, fails to validate that the code offset is within bounds, allowing an attacker to deploy empty contracts that trap funds. This could prevent legitimate contract initialization and make ETH and tokens sent to these addresses permanently inaccessible.

Technologies: [Vyper](https://junglewise.ai/threats/technologies/vyper-vyper). Vendors: [Vyper](https://junglewise.ai/threats/vendors/vyper).

## Quick answers

**Is CVE-2026-114118 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-114118 being exploited in the wild.

**How severe is CVE-2026-114118?** Medium severity, with a CVSS score of 4.8, published 21 October 2026.

**Which products and versions are affected?** Vyper 0.3.4 through 0.5.0b1.

**Is there a fix for CVE-2026-114118?** No fixed version is recorded yet. Use a fixed, valid code_offset (such as 3) rather than accepting user-controlled values, or explicitly enforce the bound code_offset < extcodesize(target) using unsigned comparison before subtraction in create_from_blueprint.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-06"}, {"kind": "advisory", "at": "2026-10-20"}] If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-114118 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-114118?** Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix


Use a fixed, valid code_offset (such as 3) rather than accepting user-controlled values, or explicitly enforce the bound code_offset < extcodesize(target) using unsigned comparison before subtraction in create_from_blueprint.</anigation>
<parameter name="timeline">[{"kind": "disclosed", "at": "2026-10-06"}, {"kind": "advisory", "at": "2026-10-20"}]

## Technical details

Vyper's create_from_blueprint builtin computes remaining blueprint code size via unsigned subtraction without first validating code_offset bounds, allowing integer wraparound to produce a small positive value that bypasses the signed comparison check. An attacker controlling code_offset can cause the EXTCODECOPY operation to read beyond the blueprint, filling the destination with zeros and resulting in initcode that starts with STOP, deploying a contract with no runtime code. This is a type confusion/incorrect comparison issue (CWE-681, CWE-697) requiring direct control of the code_offset parameter.

## Affected products

- Vyper Vyper 0.3.4 through 0.5.0b1

## References

- [https://github.com/vyperlang/vyper/security/advisories/GHSA-fxg7-4wqg-c8gh](https://github.com/vyperlang/vyper/security/advisories/GHSA-fxg7-4wqg-c8gh)
- [https://www.vulncheck.com/advisories/vyper-0.3.4-through-0.5-0b1-create-from-blueprint-offset-validation-bypass-via-unsigned-wraparound](https://www.vulncheck.com/advisories/vyper-0.3.4-through-0.5-0b1-create-from-blueprint-offset-validation-bypass-via-unsigned-wraparound)

## Related threats

- [Vyper name resolution scope vulnerability in constants and defaults](https://junglewise.ai/threats/cve-2026-114663-vyper-0-4-0b1-through-0-5-0b1-miscompiles-unfoldable-constants)
- [Vyper optimizer miscompilation in ternary expressions](https://junglewise.ai/threats/cve-2026-114117-vyper-0-3-8-through-0-5-0b1-contains-an-optimizer-miscompilation)
- [Vyper source-line table parsing allows numeric literal value manipulation](https://junglewise.ai/threats/cve-2026-114116-vyper-0-1-0b1-before-0-1-0b17-and-0-4-1-through-0-5-0b1-builds)
- [Vyper source literal value substitution via multi-byte characters](https://junglewise.ai/threats/cve-2026-114114-vyper-0-1-0b1-before-0-1-0b12-0-1-0b14-and-0-4-1-through-0-5-0b1)
- [Vyper memory corruption in internal function calls within arrays](https://junglewise.ai/threats/cve-2021-48020-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption)