Vyper EUVD-2026-106918

Exploitation requires a contract compiled with an affected Vyper version (0.3.8 through 0.5.0b1) that contains a ternary expression (a if c else b) whose arms are nested arrays - DynArray of Bytes/String, DynArray of DynArray, or static arrays of DynArray - with DIFFERING inner bounds, where the expression widens to the wider result type and the narrower arm is selected at runtime; only then are inner arrays after the first read at incorrect offsets. The decisive LIMITING factor (reflected as AT:P in CVSS 4.0) is that the contract must already contain this specific widening nested-array ternary pattern - contracts without it are entirely unaffected, which is why this is not remotely exploitable against arbitrary deployments. No special attacker authentication is needed against an affected deployed contract (PR:N), and no user interaction is required.

This is a CVSS 4.0 6.3 (Medium) compiler miscompilation (CWE-843 type confusion) with a vulnerable-system integrity impact only (VI:L; VC:N, VA:N). The 4.0 vector's AT:P (Attack Requirements: Present) is the single most important signal: exploitation is gated on a contract actually containing the specific vulnerable code pattern, so this is not a broadly exploitable flaw across all Vyper contracts. PR:N in the vector indicates that, for an affected deployed contract, no authentication is needed - any caller can trigger the misread over the network (unauthenticated). No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, which is consistent with a correctness/compiler bug rather than a mass-exploited network vulnerability; absence of EPSS/KEV data is noted, not inferred as low. The realistic risk is concentrated and high-consequence rather than widespread: the small subset of contracts compiled with affected Vyper that use widening nested-array ternaries can silently store corrupted values on an immutable ledger or revert, which is serious for those specific contracts, but the overall exploitation surface is narrow. Net: a patch-and-recompile priority for Vyper developers using the affected pattern, not an emergency for the general population. One data note: the input Tag 'Information Disclosure' sits uneasily with the vendor-aligned CVSS VC:N - the described impact is corrupted/misread values (integrity), so confidentiality impact is unconfirmed.

A developer compiles a Vyper contract (0.3.8-0.5.0b1) containing a ternary (a if c else b) that selects between nested arrays of differing inner bounds and widens to the wider type. Once deployed, when the narrower arm is selected at runtime, inner arrays after the first are read at the wrong memory offsets, so a caller receives or the contract stores corrupted values, or the transaction reverts. No public exploit was identified; VulnCheck and the GHSA advisory include compiler test cases demonstrating the miscompilation rather than a weaponized exploit, and attack complexity is low once the vulnerable pattern is present (AC:L) though it depends on that pattern existing (AT:P).