CVE-2023-41052

Name: CVE-2023-41052
Creator: NVD / NIST
Published: 2023-09-04T18:15:08.657+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 5.3/10EPSS 0.46%

Last modified Jun 17, 2026

CVE-2023-41052 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. EPSS estimates a 0.46% chance of exploitation in the next 30 days.

Description

Vyper is a Pythonic Smart Contract Language. In affected versions the order of evaluation of the arguments of the builtin functions `uint256_addmod`, `uint256_mulmod`, `ecadd` and `ecmul` does not follow source order. This behaviour is problematic when the evaluation of one of the arguments produces side effects that other arguments depend on. A patch is currently being developed on pull request #3583. When using builtins from the list above, users should make sure that the arguments of the expression do not produce side effects or, if one does, that no other argument is dependent on those side effects.

Metrics

CVSS 3.1

5.3/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

EPSS Probability

0.46%

36.2th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Vyperlang	Vyper	<= 0.3.9

References

https://github.com/vyperlang/vyper/pull/3583Patch
https://github.com/vyperlang/vyper/security/advisories/GHSA-4hg4-9mf5-wxxqExploit, Patch, Third Party Advisory
https://github.com/vyperlang/vyper/pull/3583Patch
https://github.com/vyperlang/vyper/security/advisories/GHSA-4hg4-9mf5-wxxqExploit, Patch, Third Party Advisory

Timeline

Published: Sep 4, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-41052?

How severe is CVE-2023-41052?

CVE-2023-41052 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 0.46% probability of exploitation in the next 30 days.

How do I fix CVE-2023-41052?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-41052?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST