CVE-2020-37287

Deferred Deferred - Pending Action

Vyper Call Stack Corruption in Complex Type Handling

Publication date: 2026-10-21

Last updated on: 2026-10-28

Assigner: VulnCheck

Description

Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-21

Last Modified

2026-10-28

Generated

2026-11-10

AI Q&A

2026-10-22

EPSS Evaluated

2026-11-08

NVD

CVE-2020-37287

EUVD

EUVD-2020-31283

Affected Vendors & Products

Vendor	Product	Version / Range
vyperlang	vyper	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-131	The product does not correctly calculate the size to be used when allocating a buffer, which could lead to a buffer overflow.

Attack-Flow Graph

Executive Summary

This vulnerability is a call stack corruption issue in Vyper before version 0.2.6. When multi-dimensional arrays or structs with non-base members are passed as function arguments, the compiler incorrectly assumes each subtype size is 32 bytes. This leads to corrupted function outputs and unexpected behavior in smart contracts.

Detection Guidance

This vulnerability is specific to Vyper smart contracts and cannot be detected via standard network or system commands. Instead, inspect Vyper code for use of multi-dimensional arrays or structs passed as function arguments in versions prior to 0.2.6.

Impact Analysis

If you use Vyper versions before 0.2.6, passing complex types like multi-dimensional arrays or structs to functions may cause incorrect outputs. This could lead to unexpected contract behavior, financial losses, or security breaches in decentralized applications built with Vyper.

Compliance Impact

This vulnerability primarily affects smart contracts written in Vyper by corrupting function outputs when complex types are passed as arguments. It does not directly impact compliance with GDPR, HIPAA, or similar standards unless the affected smart contracts are part of systems subject to these regulations. If such contracts handle sensitive data, the corruption could lead to data integrity issues, potentially violating compliance requirements related to accurate data processing and security.

Mitigation Strategies

Upgrade Vyper to version 0.2.6 or later to patch the vulnerability. Review and update any Vyper smart contracts using complex types as function arguments to ensure compatibility with the patched version.

Hi! I’m here to help you understand CVE-2020-37287. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...