CVE-2020-37287: Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments

Q: Which deployments are affected?

Contracts compiled with Vyper versions before 0.2.6 are affected when they pass multi-dimensional arrays or structs containing non-base members to internal or external functions.

Q: What does exploitation require?

The vulnerability is reachable over the network and does not require attacker privileges or user interaction, but exploitation has high attack complexity. An attacker would need to trigger a vulnerable function path involving the affected complex-type arguments.

Q: How can I determine whether a contract is at risk?

Check the Vyper compiler version used to build the contract and review function calls that pass multi-dimensional arrays or structs with non-base members. Contracts compiled before 0.2.6 with those argument patterns should be treated as at risk of corrupted values and incorrect outputs.

Q: What should be done to remediate the issue?

Use Vyper 0.2.6 or a later version to compile affected contracts. Review affected contract logic because prior compilations may produce corrupted values when the vulnerable call patterns are used.

Published Oct 21, 2026

Updated

Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32.

Affected Software

1 affected component

Vyper Vyper<0.2.6

Event History

Oct 21, 2026

CVE Published

via MITRE·12:36 AM

Data Sourced

via MITRE·12:36 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are affected?

Contracts compiled with Vyper versions before 0.2.6 are affected when they pass multi-dimensional arrays or structs containing non-base members to internal or external functions.

What does exploitation require?

The vulnerability is reachable over the network and does not require attacker privileges or user interaction, but exploitation has high attack complexity. An attacker would need to trigger a vulnerable function path involving the affected complex-type arguments.

How can I determine whether a contract is at risk?

Check the Vyper compiler version used to build the contract and review function calls that pass multi-dimensional arrays or structs with non-base members. Contracts compiled before 0.2.6 with those argument patterns should be treated as at risk of corrupted values and incorrect outputs.

What should be done to remediate the issue?

Use Vyper 0.2.6 or a later version to compile affected contracts. Review affected contract logic because prior compilations may produce corrupted values when the vulnerable call patterns are used.

CVE-2020-37287: Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments

Affected Software

Event History

Frequently Asked Questions

Which deployments are affected?

What does exploitation require?

How can I determine whether a contract is at risk?

What should be done to remediate the issue?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are affected?

What does exploitation require?

How can I determine whether a contract is at risk?

What should be done to remediate the issue?