Vyper: Memory corruption via nested internal function calls

Summary

Vyper, a Python-like smart contract compiler for the Ethereum Virtual Machine, contains a memory corruption flaw (CWE-787). An incorrect stack tip pointer occurs when internal function calls appear inside tuples, nested expressions, call arguments or builtins such as concat or ecrecover. Contracts compiled with affected versions can return corrupted values or pass wrong arguments to external calls, under the condition that the vulnerable code pattern is used.

Affected

• Vyper from 0.1.0b4 before 0.3.0 (per CVE record and VulnCheck)
• Vendor advisory GHSA-2r3x-4mrv-mcxf: versions >= 0.1.0b4, < 0.3.0; the vendor states the problem was only partially fixed in v0.2.6 and remained present up to v0.2.16
• Contracts compiled with affected versions that use the vulnerable call patterns

Fixed in

• The vendor states the issue is fixed in v0.3.0 by a new internal calling convention (#2447), but the v0.3.0 release page warns of a critical vulnerability (GHSA-5824-cm3x-3c38) and recommends v0.3.1 or higher
• Exact complete fix version: Unknown.
• Latest maintained release: check https://github.com/vyperlang/vyper/releases

Workaround

• No vendor-documented workaround known.
• Avoid internal function calls inside tuples, nested expressions, call arguments and builtins until the code is recompiled with a fixed version.

Exploitation

• Not listed in CISA's Known Exploited Vulnerabilities catalog.
• CISA SSVC: exploitation none, not automatable, partial technical impact.
• No reports of exploitation in the wild and no public proof-of-concept known. The advisory contains a short triggering code example.

Our recommendation

• Inventory all Vyper compiler versions in build pipelines, lockfiles and developer environments.
• Upgrade to the latest maintained Vyper release (at least v0.3.1, verify the current version on the vendor releases page).
• Recompile and re-audit contracts that use internal function calls inside tuples, call arguments, array literals or builtins.
• Assess already deployed contracts separately, as redeployment may not be possible.
• Relevant only for organisations developing, auditing or operating Ethereum smart contracts; no action needed otherwise.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• GitHub Security Advisory GHSA-2r3x-4mrv-mcxf github.com
• VulnCheck Advisory www.vulncheck.com
• GitLab Advisory Mirror GHSA-2r3x-4mrv-mcxf advisories.gitlab.com
• Vyper Release v0.3.0 github.com
• Vyper Pull Request 2345 github.com
• Vyper Releases github.com
• Snyk SNYK-PYTHON-VYPER-1252241 security.snyk.io
• CISA SSVC data via OpenCVE app.opencve.io

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 13:27.