CVE-2026-114118

Vyper versions 0.3.4 through 0.5.0b1 are vulnerable to an offset validation bypass in the create_from_blueprint function. The root cause is a uint256 subtraction performed without verifying that the code_offset is within the blueprint's code size, allowing a large offset to wrap around to a small...