---
id: "CVE-2021-48020"
kind: "vulnerability"
aliases: ["CVE-2021-48020"]
title: "Vyper: stack pointer bug corrupts memory during internal calls in arrays"
severity: "high"
cvss: 8.3
epss: 0.00284
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["ethereum", "package", "smart-contracts", "vyper"]
not_affected_if: ["no-internal-calls-in-arrays", "vyper-0.3.0-or-later"]
published_at: "2026-10-21T01:17:19+00:00"
first_seen_at: "2026-10-23T21:57:27+00:00"
updated_at: "2026-10-25T03:02:18+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-48020", "first_seen_at": "2026-10-23T21:57:27+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2021-48020", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Vyper: stack pointer bug corrupts memory during internal calls in arrays

Vyper compiler versions from 0.1.0b4 before 0.3.0 generate incorrect stack tip handling when internal function calls appear inside arrays, external call arguments, struct literals, or raw_log topics. The result is memory corruption that makes deployed smart contracts behave incorrectly.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `vyper --version` on the build machine, or the `vyper` version pinned in the project's requirements or lockfile
- Search the project for Vyper contracts that place internal calls inside array literals, external call arguments, struct literals, or `raw_log` topics

## Fix

- Upgrade Vyper to `0.3.0` or later
- Recompile and redeploy affected contracts, then re-test their behaviour

## Timeline

- 2026-10-23T21:57:27+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2021-48020
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2021-48020

## From the sources

Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract behavior.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_