CVE-2025-27105: AugAssign evaluation order causing OOB write within the object in Vyper
First published: Fri Feb 21 2025(Updated: )
Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case when target is an access to a DynArray and the rhs modifies the array, the cached target will evaluate first, and the bounds check will not be re-evaluated during the write portion of the statement. In other words, the following code ```vyper def poc(): a: DynArray[uint256, 2] = [1, 2] a[1] += a.pop() ``` is equivalent to: ```vyper def poc(): a: DynArray[uint256, 2] = [1, 2] a[1] += a[len(a) - 1] a.pop() ``` rather than: ```vyper def poc(): a: DynArray[uint256, 2] = [1, 2] s: uint256 = a[1] t: uint256 = a.pop() a[1] = s + t # reverts due to oob access ```
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| pip/vyper | <=0.4.0 | 0.4.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2025-27105?
CVE-2025-27105 is a vulnerability in Vyper that can lead to improper bounds checking of dynamic arrays, potentially resulting in exploitation.
How do I fix CVE-2025-27105?
To mitigate CVE-2025-27105, upgrade Vyper to version 0.4.1 or later.
What versions of Vyper are affected by CVE-2025-27105?
CVE-2025-27105 affects Vyper versions up to and including 0.4.0.
What consequences may arise from CVE-2025-27105 if exploited?
Exploitation of CVE-2025-27105 may allow an attacker to bypass bounds checks, leading to undefined behavior or vulnerabilities.
Is there a specific action recommended for developers using Vyper regarding CVE-2025-27105?
Developers using Vyper should immediately update to version 0.4.1 to protect against CVE-2025-27105.
- collector/mitre-cve
- source/MITRE
- collector/nvd-api
- source/NVD
- agent/last-modified-date
- agent/title
- agent/references
- agent/author
- agent/severity
- agent/weakness
- agent/source
- agent/type
- agent/description
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-4w26-8p97-f4jp
- alias/CVE-2025-27105
- agent/software-canonical-lookup
- agent/softwarecombine
- agent/event
- agent/tags
- package-manager/pip