Security Resilience

CVE-2023-32059

Vyperlang Vyper ≤ 0.3.8

Public PoC
Published
11 May 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS Score 0.0073 53th percentile
Risk Priority 59 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-32059 is a high-severity Function Call With Incorrect Order of Arguments (CWE-683) vulnerability in Vyperlang Vyper. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steganography (T1001.002); ranked in the top 47% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

Vyper is a Pythonic smart contract language for the Ethereum virtual machine. Prior to version 0.3.8, internal calls with default arguments are compiled incorrectly. Depending on the number of arguments provided in the call, the defaults are added not right-to-left,…

more

but left-to-right. If the types are incompatible, typechecking is bypassed. The ability to pass kwargs to internal functions is an undocumented feature that is not well known about. The issue is patched in version 0.3.8.

CWE(s)
CWE-683NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001.002 Steganography Command And Control
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.
attack.mitre.org →
T1001.003 Protocol or Service Impersonation Command And Control
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.007 Proc Filesystem Credential Access
Adversaries may gather credentials from the proc filesystem or `/proc`.
attack.mitre.org →
T1010 Application Window Discovery Discovery
Adversaries may attempt to get a listing of open application windows.
attack.mitre.org →
T1011.001 Exfiltration Over Bluetooth Exfiltration
Adversaries may attempt to exfiltrate data over Bluetooth rather than the command and control channel.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-27104Same product: Vyperlang Vyper
CVE-2024-32481Same product: Vyperlang Vyper
CVE-2024-24567Same product: Vyperlang Vyper
CVE-2023-39363Same product: Vyperlang Vyper
CVE-2024-32645Same product: Vyperlang Vyper
CVE-2023-30837Same product: Vyperlang Vyper
CVE-2024-24559Same product: Vyperlang Vyper
CVE-2024-24563Same product: Vyperlang Vyper
CVE-2024-24564Same product: Vyperlang Vyper
CVE-2023-42441Same product: Vyperlang Vyper

Affected Assets

vyperlang
vyper
≤ 0.3.8

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
blocks

Secure SDLC practices (code review, static analysis, compiler checks) directly catch argument-order errors during development.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.25 Secure development life cycle partial match
blocks

A secure SDLC process encourages practices that reduce such weaknesses but does not directly address argument ordering.

A.8.26 Application security requirements partial match
removes
A.8.27 Secure system architecture and engineering principles partial match
removes
A.8.28 Secure coding partial match
prevents

Secure coding standards can mandate argument-order checks and static analysis, but do not guarantee elimination of all ordering mistakes.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing in development can detect argument-order defects, yet testing coverage is rarely exhaustive.

A.8.8 Management of technical vulnerabilities partial match
removes

References