CVE-2024-24561

CVE-2024-24561 is a critical-severity vulnerability in Vyperlang Vyper with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-787.

Key facts

Description

Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for the ability for start + length to overflow when the values aren't literals. If a slice() function uses a non-literal argument for the start or length variable, this creates the ability for an attacker to overflow the bounds check. This issue can be used to do OOB access to storage, memory or calldata addresses. It can also be used to corrupt the length slot of the respective array.

Frequently asked questions

What is CVE-2024-24561?
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for the ability for start + length to overflow when the values aren't literals. If a slice() function uses a non-literal argument for the start or length variable, this creates the ability for an attacker to overflow the bounds check. This issue can be used to do OOB access to storage, memory or calldata addresses. It can also be used to corrupt the length slot of the respective array.
How severe is CVE-2024-24561?
CVE-2024-24561 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2024-24561 being actively exploited?
It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (55th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-24561?
CVE-2024-24561 affects Vyperlang Vyper. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-24561?
Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
Does CVE-2024-24561 have an EU (EUVD) identifier?
Yes. CVE-2024-24561 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-0176.
When was CVE-2024-24561 published?
CVE-2024-24561 was published on 2024-02-01 and last updated on 2026-06-17.

References

Affected products (1)

More vulnerabilities in Vyperlang Vyper

All CVEs affecting Vyperlang Vyper →

Other CWE-787 (Out-of-bounds Write) vulnerabilities

Browse all CWE-787 (Out-of-bounds Write) vulnerabilities →