# CVE-2021-48020: Vyper memory corruption in internal function calls within arrays

Source: https://junglewise.ai/threats/cve-2021-48020-vyper-from-0-1-0b4-before-0-3-0-contains-a-memory-corruption  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-21. Updated: 2026-10-21  
License: CC BY 4.0 with a link back

CVE-2021-48020 · Severity: medium · CVSS 6.5 · Published 2026-10-21

Vyper is a smart contract programming language used to create secure decentralized applications on blockchains. A memory corruption flaw allows attackers to craft contracts with internal function calls inside arrays, which can corrupt memory and cause contracts to behave unexpectedly, potentially leading to unauthorized state changes or contract logic bypasses.

Technologies: [Vyper](https://junglewise.ai/threats/technologies/vyper-vyper). Vendors: [Vyper](https://junglewise.ai/threats/vendors/vyper).

## Quick answers

**Is CVE-2021-48020 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2021-48020 being exploited in the wild.

**How severe is CVE-2021-48020?** Medium severity, with a CVSS score of 6.5, published 21 October 2026.

**Which products and versions are affected?** Vyper 0.1.0b4 to before 0.3.0.

**Is there a fix for CVE-2021-48020?** Yes: fixed in 0.3.0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2021-48020 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2021-48020?** Check whether you run Vyper at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 0.3.0

## Technical details

An incorrect stack tip pointer in Vyper's compiler causes memory corruption when internal function calls are nested within array elements, used as external call arguments, included in struct literals, or referenced in raw_log topics. The vulnerability affects all versions from 0.1.0b4 through 0.2.16, with partial fixes in v0.2.12 that did not fully address all array-related cases. A complete fix was implemented in v0.3.0 by introducing isolated memory frames for each function to prevent overlap.

## Affected products

- Vyper Vyper 0.1.0b4 to before 0.3.0

## Timeline

- 2021-04-16: disclosed

## References

- [https://github.com/vyperlang/vyper/security/advisories/GHSA-22wc-c9wj-6q2v](https://github.com/vyperlang/vyper/security/advisories/GHSA-22wc-c9wj-6q2v)
- [https://www.vulncheck.com/advisories/vyper-before-0.3.0-memory-corruption-via-internal-function-calls-in-arrays](https://www.vulncheck.com/advisories/vyper-before-0.3.0-memory-corruption-via-internal-function-calls-in-arrays)

## Related threats

- [Vyper name resolution scope vulnerability in constants and defaults](https://junglewise.ai/threats/cve-2026-114663-vyper-0-4-0b1-through-0-5-0b1-miscompiles-unfoldable-constants)
- [Vyper create_from_blueprint offset validation bypass via unsigned wraparound](https://junglewise.ai/threats/cve-2026-114118-vyper-0-3-4-through-0-5-0b1-computes-the-remaining-blueprint)
- [Vyper optimizer miscompilation in ternary expressions](https://junglewise.ai/threats/cve-2026-114117-vyper-0-3-8-through-0-5-0b1-contains-an-optimizer-miscompilation)
- [Vyper source-line table parsing allows numeric literal value manipulation](https://junglewise.ai/threats/cve-2026-114116-vyper-0-1-0b1-before-0-1-0b17-and-0-4-1-through-0-5-0b1-builds)
- [Vyper source literal value substitution via multi-byte characters](https://junglewise.ai/threats/cve-2026-114114-vyper-0-1-0b1-before-0-1-0b12-0-1-0b14-and-0-4-1-through-0-5-0b1)