Back to Database
Status published
Low
CVE-2024-24564
Vyper extract32 can ready dirty memory
Vulnerability Description
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. When using the built-in `extract32(b, start)`, if the `start` index provided has for side effect to update `b`, the byte array to extract `32` bytes from, it could be that some dirty memory is read and returned by `extract32`. This vulnerability is fixed in 0.4.0.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-24564
Credits & Attribution
No credits recorded in the NVD database.
References
More from vyperlang
View All →CVE-2025-47774
Vyper's `slice()` may elide side-effects when output length is 0
Low
2.9
CVE-2025-47285
Vyper's `concat()` builtin may elide side-effects for zero-length arguments
Low
2.9
CVE-2025-27105
AugAssign evaluation order causing OOB write within the object in Vyper
Low
2.3
CVE-2025-27104
double eval in For List Iter in Vyper
Low
2.3
CVE-2025-26622
sqrt doesn't define rounding behavior in Vyper
Low
2.3
Affected Vendor
vyperlang
View all reports →Affected Software
vyper
Vulnerable Versions:
< 0.4.0
Timeline
Official Publish:
February 26th, 2024
Last Modified:
October 25th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N