Medium severity · published Oct 21, 2026
CVE-2020-37286
Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls
6.5
CVSS
0.3%
EPSS
No
On KEV
Description
Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
None
Integrity
High
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 21% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VY
vyper · vyperlang
0.1.0b4 before 0.3.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-37286
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-37286
github.com
https://github.com/vyperlang/vyper/security/advisories/GHSA-2r3x-4mrv-mcxf
www.vulncheck.com
https://www.vulncheck.com/advisories/vyper-0.1-0b4-before-0.3.0-memory-corruption-via-nested-internal-function-calls
More from vyper
9.8
CVE-2024-24563
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine
9.8
CVE-2024-24561
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
9.8
CVE-2024-22419
Vyper is a Pythonic Smart Contract Language for the Ethereum Virtual Machine
9.8
CVE-2022-24845
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine
9.8
CVE-2022-24788
Vyper is a pythonic Smart Contract Language for the ethereum virtual machine