CVE-2024-24561

CVE-2024-24561 is a critical vulnerability affecting Vyper, a Pythonic Smart Contract Language for the Ethereum Virtual Machine, specifically versions 0.3.10 and earlier. The flaw stems from an insufficient bounds check in slice() functions when non-literal arguments are used for start or length, allowing for integer overflow. This can lead to out-of-bounds access to storage, memory, or calldata, and array length corruption. Rated 9.8 CRITICAL on the CVSS scale, this vulnerability is easily exploitable over the network with low attack complexity and no user interaction required, potentially resulting in complete compromise of confidentiality, integrity, and availability. Its FAUCET Risk Score is 93/100, indicating high risk. Currently, there is no evidence of active exploitation, nor are there publicly available exploits in Metasploit, Nuclei, or ExploitDB. Despite the lack of media coverage, the vulnerability has generated significant community discussion, with 10 mentions, suggesting awareness among cybersecurity professionals.