---
id: CVE-2020-37286
title: >-
  Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function
  Calls
summary: >-
  Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability
  caused by an incorrect stack tip pointer when internal function calls appear
  inside tuples or nested calls. Contracts using such calls as tuple elements,
  call arg…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L'
cvssSource: cna
cwe:
  - CWE-787
vendor: vyperlang
product: vyper
affected:
  - vyper >= 0.1.0b4 < 0.3.0
published: '2026-10-21'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T00:36:15.568Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2020-37286'
references:
  - url: 'https://github.com/vyperlang/vyper/security/advisories/GHSA-2r3x-4mrv-mcxf'
    label: GitHub Security Advisory (GHSA-2r3x-4mrv-mcxf)
  - url: >-
      https://www.vulncheck.com/advisories/vyper-0.1-0b4-before-0.3.0-memory-corruption-via-nested-internal-function-calls
    label: >-
      VulnCheck Advisory: Vyper 0.1.0b4 before 0.3.0 Memory Corruption via
      Nested Internal Function Calls
tags:
  - cve.org
ingestedAt: '2026-10-21T01:37:08.050Z'
---

## Overview

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.

## Affected

- `vyper >= 0.1.0b4 < 0.3.0`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.