Every CVE Search/ Get API key

CVE-2024-26149

Vyper _abi_decode Memory Overflow

3.7 LowFix available

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in _abi_decode, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within _abi_decode. This vulnerability affects 0.3.10 and earlier versions.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
Low
Integrity
None
Availability
None

Exploit likelihood

0.54%Up 0.5 points since Feb 27, 2024
90%50%10%1%

What each source reports

CVE List Score used 3.7

Vyper _abi_decode Memory Overflow

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in _abi_decode, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within _abi_decode. This vulnerability affects 0.3.10 and earlier versions.

Record
CVE-2024-26149
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-119
Updated
2026-11-02
EUVDEUVD-2024-0180 3.7

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in _abi_decode, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within _abi_decode. This vulnerability affects 0.3.10 and earlier versions.

Record
EUVD-2024-0180
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-9p8r-4xp4-gw5w 3.7

Vyper's `_abi_decode` vulnerable to Memory Overflow

Summary

If an excessively large value is specified as the starting index for an array in _abi_decode, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to bugs in contracts that use arrays within _abi_decode. The advisory has been assigned low severity, because it is only observable if there is a memory write between two invocations of abi_decode on the same input.

Proof of Concept

event Pwn:
    pass

@external
def f(x: Bytes[32 * 3]):
    a: Bytes[32] = b"foo"
    y: Bytes[32 * 3] = x

    decoded_y1: Bytes[32] = _abi_decode(y, Bytes[32])
    a = b"bar"
    decoded_y2: Bytes[32] = _abi_decode(y, Bytes[32])

    if decoded_y1 != decoded_y2:
        log Pwn()

Sending the following calldata results in Pwn being emitted.

0xd45754f8
0000000000000000000000000000000000000000000000000000000000000020
0000000000000000000000000000000000000000000000000000000000000060
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa0

Patches

Patched in https://github.com/vyperlang/vyper/pull/3925, https://github.com/vyperlang/vyper/pull/4091, https://github.com/vyperlang/vyper/pull/4144, https://github.com/vyperlang/vyper/pull/4060.

Record
GHSA-9p8r-4xp4-gw5w
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-119, CWE-120
Updated
2026-11-02
NVD 3.7

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in _abi_decode, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within _abi_decode. This vulnerability affects 0.3.10 and earlier versions.

Record
CVE-2024-26149
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-119
Updated
2026-11-02
OSV 3.7

Vyper _abi_decode Memory Overflow

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in _abi_decode, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within _abi_decode. This vulnerability affects 0.3.10 and earlier versions.

Record
CVE-2024-26149
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-119
Updated
2026-11-02
OSVGHSA-9p8r-4xp4-gw5w 3.7

Vyper's `_abi_decode` vulnerable to Memory Overflow

Summary

If an excessively large value is specified as the starting index for an array in _abi_decode, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to bugs in contracts that use arrays within _abi_decode. The advisory has been assigned low severity, because it is only observable if there is a memory write between two invocations of abi_decode on the same input.

Proof of Concept

event Pwn:
    pass

@external
def f(x: Bytes[32 * 3]):
    a: Bytes[32] = b"foo"
    y: Bytes[32 * 3] = x

    decoded_y1: Bytes[32] = _abi_decode(y, Bytes[32])
    a = b"bar"
    decoded_y2: Bytes[32] = _abi_decode(y, Bytes[32])

    if decoded_y1 != decoded_y2:
        log Pwn()

Sending the following calldata results in Pwn being emitted.

0xd45754f8
0000000000000000000000000000000000000000000000000000000000000020
0000000000000000000000000000000000000000000000000000000000000060
ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffa0

Patches

Patched in https://github.com/vyperlang/vyper/pull/3925, https://github.com/vyperlang/vyper/pull/4091, https://github.com/vyperlang/vyper/pull/4144, https://github.com/vyperlang/vyper/pull/4060.

Record
GHSA-9p8r-4xp4-gw5w
CVSS 3.1
3.7 LowCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness
CWE-119, CWE-120
Updated
2026-11-02
OSVPYSEC-2024-164 5.3

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in _abi_decode, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within _abi_decode. This vulnerability affects 0.3.10 and earlier versions.

Record
PYSEC-2024-164
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
vyper
PyPI
 before 0.4.0
0.4.0
vyper
PyPI
 before 0.4.0, plus listed versions
0.1.0b10.1.0b100.1.0b110.1.0b120.1.0b13
Show 45 moreShow less
0.1.0b140.1.0b150.1.0b160.1.0b170.1.0b20.1.0b30.1.0b40.1.0b50.1.0b60.1.0b70.1.0b80.1.0b90.2.10.2.100.2.110.2.120.2.130.2.140.2.150.2.160.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.10.3.100.3.10rc10.3.10rc20.3.10rc30.3.10rc40.3.10rc50.3.20.3.30.3.40.3.50.3.60.3.70.3.80.3.90.4.0b1
0.4.0
vyper
PyPI
 before 0.4.0b1, plus listed versions
0.1.0b10.1.0b100.1.0b110.1.0b120.1.0b13
Show 44 moreShow less
0.1.0b140.1.0b150.1.0b160.1.0b170.1.0b20.1.0b30.1.0b40.1.0b50.1.0b60.1.0b70.1.0b80.1.0b90.2.10.2.100.2.110.2.120.2.130.2.140.2.150.2.160.2.20.2.30.2.40.2.50.2.60.2.70.2.80.2.90.3.00.3.10.3.100.3.10rc10.3.10rc20.3.10rc30.3.10rc40.3.10rc50.3.20.3.30.3.40.3.50.3.60.3.70.3.80.3.9
0.4.0b1

History

History
RecordedChangedSources
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-26149 is a low vulnerability (CVSS 3.7) in Vyperlang Vyper, published February 26, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in vyper 0.4.0.

References

Show 4 moreShow less
This page doesn't list everything

Left out here: 11 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open