PT-2025-7631 · Vyper · Vyper
Charles-Cooper
·
Published
2025-02-21
·
Updated
2025-03-29
·
CVE-2025-27105
CVSS v3.1
9.1
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Vyper versions prior to 0.4.1
Description
The issue arises from how Vyper handles AugAssign statements, specifically when the target is an access to a DynArray and the right-hand side (rhs) modifies the array. In such cases, the cached target evaluates first, and the bounds check is not re-evaluated during the write portion of the statement. This can lead to out-of-bounds access. For example, the code
a[1] += a.pop() is evaluated as if a[1] is accessed before a.pop() modifies the array, bypassing the bounds check that would occur if a[1] were accessed after a.pop().Recommendations
For versions prior to 0.4.1, upgrade to version 0.4.1 or later to address this issue.
At the moment, there is no information about other workarounds for this vulnerability.
Exploit
Fix
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Vyper