CVE-2024-22419

Summary

CVE-2024-22419 is a vulnerability affecting the Vyper Pythonic Smart Contract Language for the Ethereum Virtual Machine. The `concat` built-in function can write beyond the allocated memory buffer, resulting in the overwriting of valid data. This issue stems from a flaw in the `build_IR` for `concat` that does not follow the copy functions' API. Although no vulnerable contracts were detected in production, this length-dependent buffer overflow could alter contract semantics and go undetected during testing. Vyper users are urged to update as soon as possible with the fix introduced in commit `55e18f6d1`.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.