CVE-2020-37287 Details
Description
Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32.
A call stack corruption vulnerability has been identified in Vyper versions prior to 0.2.6. This vulnerability arises when complex types containing non-base members are passed as arguments, leading to incorrect function outputs. The issue is particularly evident in contracts that pass multi-dimensional arrays or structs to internal or external functions, as the compiler incorrectly assumes that each subtype size is 32. This mismanagement of stack values results in corrupted data being received by the functions.
Users can upgrade to Vyper version 0.2.6 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 21, 2026CISA-ADP
Assessed Oct 28, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-131 | Incorrect Calculation of Buffer Size | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Vyper | < 0.2.6 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 28, 2026 | CVE Modified | CISA-ADP |
| Oct 21, 2026 | New CVE Received | [email protected] |