Is CVE-2025-21607 in the CISA KEV catalog?

No. CVE-2025-21607 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2025-21607?

CVE-2025-21607 has a CVSS v3 base score of 7.5 (HIGH).

What is the EPSS score for CVE-2025-21607?

CVE-2025-21607 has an EPSS score of 0.65% (47th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2025-21607?

Upgrade vyper to 0.4.1 or later.

CVE & CISA-KEV Catalog

CVE-2025-21607

HIGH

7.5

CVSS v3

NVD

Description

Vyper is a Pythonic Smart Contract Language for the EVM. When the Vyper Compiler uses the precompiles EcRecover (0x1) and Identity (0x4), the success flag of the call is not checked. As a consequence an attacker can provide a specific amount of gas to make these calls fail but let the overall execution continue. Then the execution result can be incorrect. Based on EVM's rules, after the failed precompile the remaining code has only 1/64 of the pre-call-gas left (as 63/64 were forwarded and spent). Hence, only fairly simple executions can follow the failed precompile calls. Therefore, we found no significantly impacted real-world contracts. None the less an advisory has been made out of an abundance of caution. This issue is fixed in 0.4.1.

CWE-670

How to fix

Remediation Available

vyperNVD

Affected:< 0.4.1Fixed in:0.4.1CVE-2025-21607derived from NVD

TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityHigh

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploit Intelligence

0.65%probability of exploitation in 30 days

47thpercentile

Moderate risk: more likely to be exploited than 47% of all known CVEs.

References

Exploit1

github.com

Other references2

Related Vulnerabilities

Other CWE-670 vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2020-9425	High	7.5	17%	-	Fix
CVE-2019-9946	High	7.5	3.1%	-	Fix
CVE-2024-32896	High	7.8	3.0%	KEV	-
CVE-2019-17192	Critical	9.8	2.7%	-	-
CVE-2026-38361	High	7.5	2.6%	-	-
CVE-2020-1914	Critical	9.8	2.5%	-	Fix

Embed a live status badge for CVE-2025-21607

Markdown

[![CVE-2025-21607](https://tridentstack.com/cve/badge/CVE-2025-21607.svg)](https://tridentstack.com/cve/CVE-2025-21607)

HTML

<a href="https://tridentstack.com/cve/CVE-2025-21607"><img src="https://tridentstack.com/cve/badge/CVE-2025-21607.svg" alt="CVE-2025-21607"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

See how it works Start freeThis CVE lookup is free and always will be.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2025-04-24.