# CVE-2020-37286: Vyper memory corruption in nested internal function calls

Source: https://junglewise.ai/threats/cve-2020-37286-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2020-37286 · Severity: medium · CVSS 6.5 · Published 2026-10-21

Vyper is a smart contract programming language used to write code for the Ethereum blockchain. A memory corruption flaw in versions 0.1.0b4 to 0.2.x causes incorrect values to be returned or passed to external functions when internal functions are nested inside tuples or function calls. An attacker could exploit a vulnerable contract to trigger wrong behavior, such as transferring funds to incorrect addresses or causing contract failures.

Technologies: [Vyper](https://junglewise.ai/threats/technologies/vyper-vyper). Vendors: [Vyper](https://junglewise.ai/threats/vendors/vyper).

## Quick answers

**Is CVE-2020-37286 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-37286 being exploited in the wild.

**How severe is CVE-2020-37286?** Medium severity, with a CVSS score of 6.5, published 21 October 2026.

**Which products and versions are affected?** Vyper 0.1.0b4 to 0.2.x.

**Is there a fix for CVE-2020-37286?** Yes: fixed in 0.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2020-37286 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2020-37286?** Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.3.0

## Technical details

The vulnerability is caused by an incorrect stack pointer when internal function calls are nested or used as arguments within tuples or other function calls. This affects internal calls nested in expressions, calls used as arguments to external functions or builtins like concat and ecrecover, and subscripted calls. The flaw results in memory corruption that leads to corrupted return values or wrong arguments being passed to external calls, and is fixed by the new internal calling convention in version 0.3.0.

## Affected products

- Vyper Vyper 0.1.0b4 to 0.2.x

## Timeline

- 2020-10-10: disclosed
- 2020: patched: Partial fixes in v0.2.6 (yanked), v0.2.7, v0.2.12, v0.2.16; complete fix in v0.3.0

## References

- [https://github.com/vyperlang/vyper/security/advisories/GHSA-2r3x-4mrv-mcxf](https://github.com/vyperlang/vyper/security/advisories/GHSA-2r3x-4mrv-mcxf)
- [https://www.vulncheck.com/advisories/vyper-0.1-0b4-before-0.3.0-memory-corruption-via-nested-internal-function-calls](https://www.vulncheck.com/advisories/vyper-0.1-0b4-before-0.3.0-memory-corruption-via-nested-internal-function-calls)

## Related threats

- [Vyper name resolution scope vulnerability in constants and defaults](https://junglewise.ai/threats/cve-2026-114663-vyper-0-4-0b1-through-0-5-0b1-miscompiles-unfoldable-constants)
- [Vyper create_from_blueprint offset validation bypass via unsigned wraparound](https://junglewise.ai/threats/cve-2026-114118-vyper-0-3-4-through-0-5-0b1-computes-the-remaining-blueprint)
- [Vyper optimizer miscompilation in ternary expressions](https://junglewise.ai/threats/cve-2026-114117-vyper-0-3-8-through-0-5-0b1-contains-an-optimizer-miscompilation)
- [Vyper source-line table parsing allows numeric literal value manipulation](https://junglewise.ai/threats/cve-2026-114116-vyper-0-1-0b1-before-0-1-0b17-and-0-4-1-through-0-5-0b1-builds)
- [Vyper source literal value substitution via multi-byte characters](https://junglewise.ai/threats/cve-2026-114114-vyper-0-1-0b1-before-0-1-0b12-0-1-0b14-and-0-4-1-through-0-5-0b1)