What is CVE-2024-32481?

CVE-2024-32481 is a medium-severity vulnerability in Vyperlang Vyper, classified under Incorrect Conversion between Numeric Types. CVSS score: 5.3/10. Published 2024-04-25.

How severe is CVE-2024-32481?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Is CVE-2024-32481 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Vulnerability in Vyperlang Vyper

CVE-2024-32481

Vyper is a pythonic Smart Contract Language for the Ethereum virtual machine. Starting in version 0.3.8 and prior to version 0.4.0b1, when looping over a `range` of the form `range(start, start + N)`, if `start` is negative, the execution will always revert. This issue is caused by an incorrect assertion inserted by the code generation of the range `stmt.parse_For_range()`. The issue arises when `start` is signed, instead of using `sle`, `le` is used and `start` is interpreted as an unsigned integer for the comparison. If it is a negative number, its 255th bit is set to `1` and is hence interpreted as a very large unsigned integer making the assertion always fail. Any contract having a `range(start, start + N)` where `start` is a signed integer with the possibility for `start` to be negative is affected. If a call goes through the loop while supplying a negative `start` the execution will revert. Version 0.4.0b1 fixes the issue.

Published 2024-04-25 · last modified 2026-06-17.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

EPSS exploit prediction

EPSS: 0.008 (54.8th percentile), scored 2026-09-30.

Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 55th percentile — 54.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.

EPSS over last 30 days · oldest: 0.008 · newest: 0.008 · change: 0.000

Affected products

Vyperlang Vyper — versions >= 0.3.8, < 0.4.0b1, 0.4.0

Weakness classification (CWE)

CWE-681 — Incorrect Conversion between Numeric Types

Public proof-of-concept exploits

fkie-cad/nvd-json-data-feeds

References

github.com/vyperlang/vyper/security/advisories/GHSA-ppx5-q359-pvwj (Exploit, Vendor Advisory)
github.com/vyperlang/vyper/commit/3de1415ee77a9244eb04bdb695e249d3ec9ed868 (Patch)
github.com/vyperlang/vyper/commit/5319cfbe14951e007ccdb323257e5ada869b35d5 (Patch)
github.com/vyperlang/vyper/blob/9136169468f317a53b4e7448389aa315f90b95ba/vyper/… (Product)

Frequently asked questions

What is CVE-2024-32481?: CVE-2024-32481 is a medium-severity vulnerability in Vyperlang Vyper, classified under Incorrect Conversion between Numeric Types. CVSS score: 5.3/10. Published 2024-04-25.
How severe is CVE-2024-32481?: Medium severity. CVSS v3 base score is 5.3 out of 10.
Is CVE-2024-32481 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.