// For flags

CVE-2024-26149

Vyper _abi_decode Memory Overflow

Severity Score

3.7
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

Track*
*SSVC
Descriptions

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within `_abi_decode`. This vulnerability affects 0.3.10 and earlier versions.

Vyper es un lenguaje de contrato inteligente pitónico para la máquina virtual ethereum. Si se especifica un valor excesivamente grande como índice inicial para una matriz en `_abi_decode`, puede provocar que la posición de lectura se desborde. Esto da como resultado la decodificación de valores fuera de los límites previstos de la matriz, lo que potencialmente conduce a explotaciones en contratos que usan matrices dentro de `_abi_decode`. Esta vulnerabilidad afecta a la versión 0.3.10 y versiones anteriores.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:Track*
Exploitation
Poc
Automatable
No
Tech. Impact
Partial
* Organization's Worst-case Scenario
Timeline
  • 2024-02-14 CVE Reserved
  • 2024-02-26 CVE Published
  • 2024-02-27 EPSS Updated
  • 2024-08-22 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
CAPEC
References (1)
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Vyperlang
Search vendor "Vyperlang"
Vyper
Search vendor "Vyperlang" for product "Vyper"
<= 0.3.10
Search vendor "Vyperlang" for product "Vyper" and version " <= 0.3.10"
en
Affected