CVE-2025-27105

AugAssign evaluation order causing OOB write within the object in Vyper

State: Published
Severity: 2.3 Low
Published: Feb 21, 2025
Updated: Feb 22, 2025
Reserved: Feb 18, 2025

Description

vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case when target is an access to a DynArray and the rhs modifies the array, the cached target will evaluate first, and the bounds check will not be re-evaluated during the write portion of the statement. This issue has been addressed in version 0.4.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

Scores

CVSS	Score	Vector	Source
4.0	2.3 Low	CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N	GitHub_M
3.1	9.1 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H	CISA-ADP

Weaknesses

CWE-787 Out-of-bounds Write

Affected Products

Product	Versions
vypervyperlang	< 0.4.1Affected

References

https://github.com/vyperlang/vyper/security/advisories/GHSA-4w26-8p97-f4jp

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.