Is CVE-2021-48020 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2021-48020 being exploited in the wild.

How severe is CVE-2021-48020?

Medium severity, with a CVSS score of 6.5, published 21 October 2026.

Is there a fix for CVE-2021-48020?

Yes: fixed in 0.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2021-48020 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2021-48020?

Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2021-48020: Vyper memory corruption in internal function calls within arrays

CVE-2021-48020 · Severity: medium · CVSS 6.5 · Published 2026-10-21

Vyper is a smart contract programming language used to create secure decentralized applications on blockchains. A memory corruption flaw allows attackers to craft contracts with internal function calls inside arrays, which can corrupt memory and cause contracts to behave unexpectedly, potentially leading to unauthorized state changes or contract logic bypasses.

Technologies: Vyper. Vendors: Vyper.

Quick answers

Is CVE-2021-48020 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2021-48020 being exploited in the wild.
How severe is CVE-2021-48020?: Medium severity, with a CVSS score of 6.5, published 21 October 2026.
Which products and versions are affected?: Vyper 0.1.0b4 to before 0.3.0.
Is there a fix for CVE-2021-48020?: Yes: fixed in 0.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2021-48020 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2021-48020?: Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 0.3.0

Technical details

An incorrect stack tip pointer in Vyper's compiler causes memory corruption when internal function calls are nested within array elements, used as external call arguments, included in struct literals, or referenced in raw_log topics. The vulnerability affects all versions from 0.1.0b4 through 0.2.16, with partial fixes in v0.2.12 that did not fully address all array-related cases. A complete fix was implemented in v0.3.0 by introducing isolated memory frames for each function to prevent overlap.

Affected products

Vyper Vyper 0.1.0b4 to before 0.3.0

Timeline

2021-04-16: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.