Vyper: Call stack corruption with complex type function arguments
Summary
Vyper, a smart contract compiler for Ethereum-compatible blockchains, contains a call stack corruption bug. Contracts that pass multi-dimensional arrays or structs to internal or external functions receive incorrect values, because the compiler assumed each subtype has a size of 32 bytes. An attacker can not directly exploit this, but affected contract logic may return or store wrong data.
Affected
- Vyper versions before 0.2.6
- Smart contracts compiled with these versions that pass multi-dimensional arrays or structs between functions
Fixed in
- Vyper 0.2.6 (released 2020)
Workaround
Unknown.
Exploitation
- Not known to be exploited in the wild; not listed in CISA KEV
- No separate public proof of concept found; the upstream advisory includes a minimal reproduction
Our recommendation
- Check whether Vyper is used in your development or by contractors, and which version
- Check lockfiles and build pipelines for vyper below 0.2.6
- Upgrade to Vyper 0.2.6 or later and recompile affected contracts
- Assess affected contracts with developers and plan redeployment or migration where possible
- Monitor NVD and the GitHub advisory for updates, as the NVD entry is still Deferred and scores differ between sources
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-4v7v-gqf9-ww2g github.com
- VulnCheck Advisory www.vulncheck.com
- OSV GHSA-4v7v-gqf9-ww2g osv.dev
- OpenCVE CVE-2020-37287 app.opencve.io
- Threatint CVE-2020-37287 cve.threatint.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 15:22.
Original description (NVD)
Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.