CVE-2025-27105
Vyper DynArray AugAssign allows out-of-bounds write. Upgrade to 0.4.1.
- CVSS 2.3
- CWE-787 Out-of-bounds Write
- Design Defects
- Remote
vyper is a Pythonic Smart Contract Language for the EVM. Vyper handles AugAssign statements by first caching the target location to avoid double evaluation. However, in the case when target is an access to a DynArray and the rhs modifies the array, the cached target will evaluate first, and the bounds check will not be re-evaluated during the write portion of the statement. This issue has been addressed in version 0.4.1 and all users are advised to upgrade. There are no known workarounds for this vulnerability.
- CVSS base score
- 2.3
- Published
- 2025-02-21
- OWASP
- A03 Injection
- Orthogonal defect classification
- Algorithm
- Code defect classification
- Incorrect Algorithm
- Category
- Design Defects
- Subcategory
- Numeric Errors
- Accessibility scope
- Remote
- Impact
- Privilege Escalation
- Affected component
- Vyper
- Fixed by upgrading
- Yes
Solution
Upgrade to Vyper version 0.4.1 or later.
Vulnerable code sample
class DynArray:
def __init__(self, initial_size, max_size):
self.data = [0] * initial_size
self.length = initial_size
self.max_size = max_size
def __getitem__(self, index):
if index < 0 or index >= self.length:
raise IndexError("Index out of bounds")
return self.data[index]
def __setitem__(self, index, value):
if index < 0 or index >= self.length:
raise IndexError("Index out of bounds")
self.data[index] = value
def append(self, value):
if self.length >= self.max_size:
raise Exception("Array is full")
self.data[self.length] = value
self.length += 1
def vulnerable_aug_assign(arr, index, increment):
target_location = arr[index]
arr.append(1)
arr[index] = target_location + increment
arr = DynArray(2, 4)
arr[0] = 1
arr[1] = 2
try:
vulnerable_aug_assign(arr, 0, 5)
print("AugAssign completed (potentially incorrectly)")
print(arr.data)
except IndexError as e:
print(f"IndexError caught: {e}")
except Exception as e:
print(f"Exception caught: {e}")Patched code sample
class DynArray:
def __init__(self, initial_size, max_size):
self.data = [0] * initial_size
self.length = initial_size
self.max_size = max_size
def __getitem__(self, index):
if index < 0 or index >= self.length:
raise IndexError("Index out of bounds")
return self.data[index]
def __setitem__(self, index, value):
if index < 0 or index >= self.length:
raise IndexError("Index out of bounds")
self.data[index] = value
def append(self, value):
if self.length >= self.max_size:
raise Exception("Array is full")
self.data.append(value)
self.length += 1
def safe_aug_assign(arr, index, increment):
arr.append(1)
arr[index] = arr[index] + increment
arr = DynArray(2, 4)
arr[0] = 1
arr[1] = 2
try:
safe_aug_assign(arr, 0, 5)
print("AugAssign completed safely")
print(arr.data)
except IndexError as e:
print(f"IndexError caught: {e}")
except Exception as e:
print(f"Exception caught: {e}")Payload
# Vulnerable Vyper code example demonstrating CVE-2025-27105
# (This code is for demonstration purposes only and should not be deployed)
@public
def exploit(index: uint256):
self.my_array[index] += self.modify_array()
@public
def modify_array() -> uint256:
self.my_array.append(123)
return 1
@public
def __init__():
self.my_array = DynArray[uint256, 5]
self.my_array.append(1)
self.my_array.append(2)
self.my_array.append(3)
self.my_array.append(4)
self.my_array.append(5)
my_array: DynArray[uint256, 5]Cite this entry
@misc{vaitp:cve202527105,
title = {{Vyper DynArray AugAssign allows out-of-bounds write. Upgrade to 0.4.1.
}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2025},
note = {VAITP Python Vulnerability Dataset, entry CVE-2025-27105},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2025-27105/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::