CVE-2024-24561
CVSS v3
9.8
CRITICAL
EPSS Score
1.6 %
exploit probability
CISA KEV
No
known exploited
Exploitation
—
SSVC status
Description
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for the ability for start + length to overflow when the values aren't literals. If a slice() function uses a non-literal argument for the start or length variable, this creates the ability for an attacker to overflow the bounds check. This issue can be used to do OOB access to storage, memory or calldata addresses. It can also be used to corrupt the length slot of the respective array.
Technical details
- Published
- 2024-02-01
Frequently asked questions
What is CVE-2024-24561?
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In versions 0.3.10 and earlier, the bounds check for slices does not account for the ability for start + length to overflow when the values aren't literals. If a slice() function uses a non-literal argument for the start or length variable, this creates the ability for an attacker to overflow the bounds check. This issue can be used to do OOB access to storage, memory or calldata addresses. It can also be used to corrupt the length slot of the respective array.
Is CVE-2024-24561 actively exploited?
Active exploitation of CVE-2024-24561 has not been confirmed. The EPSS score is 1.6%, indicating the estimated probability of exploitation in the next 30 days.
What is the CVSS score for CVE-2024-24561?
CVE-2024-24561 has a CVSS v3 base score of 9.8 (CRITICAL severity).
Is CVE-2024-24561 affecting your environment?
Use isMalicious to check if any of your IPs or domains are associated with this vulnerability's IOCs.
No credit card required · 500 free checks/month · Free API key
Other 2024 vulnerabilities worth triaging
Ranked by exploit probability (EPSS).