CVE-2024-26149

MediumCVSS 5.3/10Last modified Jun 17, 2026

Description

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. If an excessively large value is specified as the starting index for an array in `_abi_decode`, it can cause the read position to overflow. This results in the decoding of values outside the intended array bounds, potentially leading to exploitations in contracts that use arrays within `_abi_decode`. This vulnerability affects 0.3.10 and earlier versions.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
vyperlang	vyper	<= 0.3.10
vyperlang	vyper	<= 0.3.10

References

https://github.com/vyperlang/vyper/security/advisories/GHSA-9p8r-4xp4-gw5wExploit, Patch, Vendor Advisory
https://github.com/vyperlang/vyper/security/advisories/GHSA-9p8r-4xp4-gw5wExploit, Patch, Vendor Advisory

Timeline

Published: Feb 26, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-26159.8Memory safety bugs present in Firefox 123. Some of these bugs showed evidence of memory corruption and we presume that with enough effort so CVE-2024-261507.5`@backstage/backend-common` is a common functionality library for backends for Backstage, an open platform for building developer portals. I CVE-2024-261515.4The `mjml` PyPI package, found at the `FelixSchwarz/mjml-python` GitHub repo, is an unofficial Python port of MJML, a markup language create CVE-2024-261526.1### Summary On all Label Studio versions prior to 1.11.0, data imported via file upload feature is not properly sanitized prior to being ren CVE-2024-261537.4All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.9.19 are vulnerable to cross-site request forgery (CSRF). An external a CVE-2024-261546.1All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting in the appliance si CVE-2024-261558.6All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 expose clear text credentials in the web portal. An attacker can acc CVE-2024-261566.1All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in th CVE-2024-261576.1All versions of ETIC Telecom Remote Access Server (RAS) prior to 4.5.0 are vulnerable to reflected cross site scripting (XSS) attacks in ge CVE-2024-261587.8Microsoft Install Service Elevation of Privilege Vulnerability CVE-2024-261598.8Microsoft ODBC Driver Remote Code Execution Vulnerability CVE-2024-26162.7To harden ICU against exploitation, the behavior for out-of-memory conditions was changed to crash instead of attempt to continue. This vuln