---
id: "CVE-2020-37286"
kind: "vulnerability"
aliases: ["CVE-2020-37286"]
title: "Vyper compiler: stack pointer bug corrupts memory in nested internal calls"
severity: "high"
cvss: 8.3
epss: 0.00284
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ethereum", "package", "python", "smart-contracts", "vyper"]
not_affected_if: ["no-vyper-contracts", "vyper-0.3.0-or-later"]
published_at: "2026-10-21T01:17:18+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T03:02:19+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-37286", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2020-37286", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Vyper compiler: stack pointer bug corrupts memory in nested internal calls

Vyper versions from 0.1.0b4 before 0.3.0 generate incorrect stack handling when internal function calls appear inside tuples or nested calls. Affected smart contracts can return corrupted values or pass wrong arguments to external calls.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `vyper --version` in the build environment and check whether it reports a version below `0.3.0`.
- Search the project's dependency lock files for `vyper` pinned below `0.3.0`.
- Look for contracts that call internal functions inside tuple returns, call arguments, or builtins such as `concat` or `ecrecover`.

## Fix

- Upgrade the Vyper compiler to `0.3.0` or later.
- Recompile and redeploy affected contracts, then re-run their tests.

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2020-37286
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2020-37286

## From the sources

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls appear inside tuples or nested calls. Contracts using such calls as tuple elements, call arguments, or builtin arguments like concat or ecrecover can return corrupted values or pass wrong arguments to external calls.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_