{"id":"CVE-2024-24564","aliases":["EUVD-2024-0181","GHSA-4hwq-4cpm-8vmx","PYSEC-2024-205"],"status":"published","title":"Vyper extract32 can ready dirty memory","description":"Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00561,"percentile":0.46978,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125"],"published":"2024-02-26T20:11:35Z","modified":"2026-10-28T02:31:12Z","fixes":[{"ecosystem":"PyPI","package":"vyper","fixed_in":["0.4.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"vyper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"0.3.10"},{"fixed":"0.4.0"}]}]},{"source":"osv","ecosystem":"PyPI","package":"vyper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}],"versions":["0.1.0b1","0.1.0b10","0.1.0b11","0.1.0b12","0.1.0b13","0.1.0b14","0.1.0b15","0.1.0b16","0.1.0b17","0.1.0b2","0.1.0b3","0.1.0b4","0.1.0b5","0.1.0b6","0.1.0b7","0.1.0b8","0.1.0b9","0.2.1","0.2.10","0.2.11","0.2.12","0.2.13","0.2.14","0.2.15","0.2.16","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.2.8","0.2.9","0.3.0","0.3.1","0.3.10","0.3.10rc1","0.3.10rc2","0.3.10rc3","0.3.10rc4","0.3.10rc5","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","0.4.0b1","0.4.0b2","0.4.0b3","0.4.0b4","0.4.0b5","0.4.0b6","0.4.0rc1","0.4.0rc2","0.4.0rc3","0.4.0rc4","0.4.0rc5","0.4.0rc6"]},{"source":"osv","ecosystem":"PyPI","package":"vyper","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"3d9c537142fb99b2672f21e2057f5f202cde194f"}]},{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.0"}]}],"versions":["0.1.0b1","0.1.0b10","0.1.0b11","0.1.0b12","0.1.0b13","0.1.0b14","0.1.0b15","0.1.0b16","0.1.0b17","0.1.0b2","0.1.0b3","0.1.0b4","0.1.0b5","0.1.0b6","0.1.0b7","0.1.0b8","0.1.0b9","0.2.1","0.2.10","0.2.11","0.2.12","0.2.13","0.2.14","0.2.15","0.2.16","0.2.2","0.2.3","0.2.4","0.2.5","0.2.6","0.2.7","0.2.8","0.2.9","0.3.0","0.3.1","0.3.10","0.3.10rc1","0.3.10rc2","0.3.10rc3","0.3.10rc4","0.3.10rc5","0.3.2","0.3.3","0.3.4","0.3.5","0.3.6","0.3.7","0.3.8","0.3.9","0.4.0b1","0.4.0b2","0.4.0b3","0.4.0b4","0.4.0b5","0.4.0b6","0.4.0rc1","0.4.0rc2","0.4.0rc3","0.4.0rc4","0.4.0rc5","0.4.0rc6","v0.4.0rc6","v0.4.0rc5","v0.4.0rc4","v0.4.0rc3","v0.4.0rc2","v0.4.0rc1","v0.4.0b6","v0.4.0b5","v0.4.0b4","v0.4.0b3","v0.4.0b2","v0.4.0b1","v0.3.10","v0.3.10rc5","v0.3.10rc4","v0.3.10rc3","v0.3.10rc2","v0.3.10rc1","v0.3.9","v0.3.8","v0.3.7","v0.3.6","v0.3.5","v0.3.4","pre-release","v0.3.3","v0.3.2","v0.3.1","v0.3.0","v0.2.16","v0.2.15","v0.2.14","v0.2.13","v0.2.12","v0.2.11","v0.2.10","v0.2.9","v0.2.8","v0.2.7","v0.2.6","v0.2.5","v0.2.4","v0.2.3","v0.2.2","v0.2.1","v0.2.0","v0.1.0-beta.17","v0.1.0-beta.16","v0.1.0-beta.15","v0.1.0-beta.14","v0.1.0-beta.13","v0.1.0-beta.12","v0.1.0-beta.11","v0.1.0-beta.10","v0.1.0-beta.9","v0.1.0-beta.8","v0.1.0-beta.7","v0.1.0-beta.6","v0.1.0-beta.5","v0.1.0-beta.3","v0.1.0-beta.2","v0.1.0-beta.1","v0.0.4"]}],"products":[{"vendor":"vyperlang","product":"vyper"}],"references":[{"url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-4hwq-4cpm-8vmx","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web","evidence"]},{"url":"https://github.com/vyperlang/vyper/commit/3d9c537142fb99b2672f21e2057f5f202cde194f","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/vyperlang/vyper/blob/10564dcc37756f3d3684b7a91fd8f4325a38c4d8/vyper/builtins/functions.py#L916-L918","tags":["web"]},{"url":"https://github.com/vyperlang/vyper/blob/10564dcc37756f3d3684b7a91fd8f4325a38c4d8/vyper/builtins/functions.py#L920-L922","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24564","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/vyper/PYSEC-2024-205.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-4hwq-4cpm-8vmx","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/24xxx/CVE-2024-24564.json","tags":["advisory"]},{"url":"https://github.com/vyperlang/vyper","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-24564","title":"Vyper extract32 can ready dirty memory","description":"Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.","status":"published","published":"2024-02-26T20:16:13.604Z","modified":"2024-10-25T20:33:03.845Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:34:13.991836Z"}],"euvd":[{"id":"EUVD-2024-0181","description":"Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.","status":"published","published":"2024-02-26T20:16:13Z","modified":"2024-10-25T20:33:03Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-03T00:05:17.135828Z"}],"ghsa":[{"id":"GHSA-4hwq-4cpm-8vmx","title":"Vyper's `extract32` can ready dirty memory","description":"### Summary\n\nWhen using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`.\n\nAs of v0.4.0 (specifically, commit https://github.com/vyperlang/vyper/commit/3d9c537142fb99b2672f21e2057f5f202cde194f), the compiler will panic instead of generating bytecode.\n\n### Details\n\nBefore evaluating `start`, the function `Extract32.build_IR` caches only:\n\n- The pointer in memory/storage to `b`: https://github.com/vyperlang/vyper/blob/10564dcc37756f3d3684b7a91fd8f4325a38c4d8/vyper/builtins/functions.py#L916-L918\n- The length of `b`: https://github.com/vyperlang/vyper/blob/10564dcc37756f3d3684b7a91fd8f4325a38c4d8/vyper/builtins/functions.py#L920-L922\n\nbut do not cache the actual content of `b`. This means that if the evaluation of `start` changes `b`'s content and length, an outdated length will be used with the new content when extracting 32 bytes from `b`.\n\n### PoC\n\nCalling the function `foo` of the following contract returns `b'uuuuuuuuuuuuuuuuuuuuuuuuuuu\\x00\\x00789'` meaning that `extract32` accessed some dirty memory.\n\n```Vyper\nvar:Bytes[96]\n\n@internal\ndef bar() -\u003e uint256:\n    self.var = b'uuuuuuuuuuuuuuuuuuuuuuuuuuuuuu'\n    self.var = b''\n    return 3\n\n@external\ndef foo() -\u003e bytes32:\n    self.var = b'abcdefghijklmnopqrstuvwxyz123456789'\n    return extract32(self.var, self.bar(), output_type=bytes32)\n    # returns b'uuuuuuuuuuuuuuuuuuuuuuuuuuu\\x00\\x00789'\n```\n\n### Impact\n\nFor contracts that are affected, it means that calling `extract32` returns dirty memory bytes instead of some expected output.","status":"published","published":"2024-02-26T20:11:35Z","modified":"2026-03-24T05:08:21Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:39:40.633038Z"}],"nvd":[{"id":"CVE-2024-24564","description":"Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.","status":"published","published":"2024-02-26T20:19:05.627Z","modified":"2026-06-17T07:14:36.98Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:09:38.473056Z"}],"osv":[{"id":"CVE-2024-24564","title":"Vyper extract32 can ready dirty memory","description":"Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.","status":"published","published":"2024-02-26T20:16:13.604Z","modified":"2026-10-28T02:31:12.659911454Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:44:38.897406Z"},{"id":"GHSA-4hwq-4cpm-8vmx","title":"Vyper's `extract32` can ready dirty memory","description":"### Summary\n\nWhen using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`.\n\nAs of v0.4.0 (specifically, commit https://github.com/vyperlang/vyper/commit/3d9c537142fb99b2672f21e2057f5f202cde194f), the compiler will panic instead of generating bytecode.\n\n### Details\n\nBefore evaluating `start`, the function `Extract32.build_IR` caches only:\n\n- The pointer in memory/storage to `b`: https://github.com/vyperlang/vyper/blob/10564dcc37756f3d3684b7a91fd8f4325a38c4d8/vyper/builtins/functions.py#L916-L918\n- The length of `b`: https://github.com/vyperlang/vyper/blob/10564dcc37756f3d3684b7a91fd8f4325a38c4d8/vyper/builtins/functions.py#L920-L922\n\nbut do not cache the actual content of `b`. This means that if the evaluation of `start` changes `b`'s content and length, an outdated length will be used with the new content when extracting 32 bytes from `b`.\n\n### PoC\n\nCalling the function `foo` of the following contract returns `b'uuuuuuuuuuuuuuuuuuuuuuuuuuu\\x00\\x00789'` meaning that `extract32` accessed some dirty memory.\n\n```Vyper\nvar:Bytes[96]\n\n@internal\ndef bar() -\u003e uint256:\n    self.var = b'uuuuuuuuuuuuuuuuuuuuuuuuuuuuuu'\n    self.var = b''\n    return 3\n\n@external\ndef foo() -\u003e bytes32:\n    self.var = b'abcdefghijklmnopqrstuvwxyz123456789'\n    return extract32(self.var, self.bar(), output_type=bytes32)\n    # returns b'uuuuuuuuuuuuuuuuuuuuuuuuuuu\\x00\\x00789'\n```\n\n### Impact\n\nFor contracts that are affected, it means that calling `extract32` returns dirty memory bytes instead of some expected output.","status":"published","published":"2024-02-26T20:11:35Z","modified":"2026-06-10T17:14:16.143920297Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:46:37.148947Z"},{"id":"PYSEC-2024-205","description":"Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.","status":"published","published":"2024-02-26T20:19:05Z","modified":"2026-06-10T17:14:16.567026987Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:54.242332Z"}]}}