CVE Feed

    Dashboard / CVE / CVE-2021-48020

    CVE-2021-48020

    Vyper from 0.1.0b4 before 0.3.0 contains a memory corruption vulnerability caused by an incorrect stack tip pointer when internal function calls are performed inside arrays. Contracts placing internal calls in nested array elements, external call arguments, struct literals, or raw_log topics can have memory corrupted, producing incorrect contract behavior.

    Published:Oct 21, 2026
    Last Modified:Oct 28, 2026
    EPS:Oct 21, 2026
    EPSS Score:0.00284
    CVSS Score:6.5

    Affected Products

    Vendor
    Vyperlang
    Product
    Vyper

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-787 Out-of-bounds Write

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    Related CVEs

    CVE-2026-114663 (CVSS 8.6) — Vyper 0.4.0b1 through 0.5.0b1 miscompiles unfoldable constants and omitted default arguments from imported mod…
    CVE-2026-114118 (CVSS 6.3) — Vyper 0.3.4 through 0.5.0b1 computes the remaining blueprint size in create_from_blueprint by uint256 subtract…
    CVE-2026-114117 (CVSS 8.2) — Vyper 0.3.8 through 0.5.0b1 contains an optimizer miscompilation in which (msg.value | K) or (len(msg.data) | …
    CVE-2026-114116 (CVSS 6) — Vyper 0.1.0b1 before 0.1.0b17 and 0.4.1 through 0.5.0b1 builds its source-line table with str.splitlines(), wh…
    CVE-2026-114115 (CVSS 6.3) — Vyper 0.3.8 through 0.5.0b1 contains a compiler miscompilation vulnerability in parse_IfExp that reads nested …
    CVE-2026-114114 (CVSS 6) — Vyper 0.1.0b1 before 0.1.0b12, 0.1.0b14, and 0.4.1 through 0.5.0b1 mix character-based line offsets with Pytho…
    CVE-2021-48019 (CVSS 6.3) — Vyper before 0.2.9 deploys forwarder proxies through the built-in create_forwarder_to function that report a f…
    CVE-2021-48018 (CVSS 8.3) — Vyper from 0.2.13 before 0.2.15 allocates storage slots for @nonreentrant reentrancy locks at the same locatio…
    CVE-2020-37289 (CVSS 6.3) — Vyper before 0.3.1 lacks a uint8 type, allowing interface return values declared as uint8, such as ERC20.decim…
    CVE-2020-37288 (CVSS 6.3) — Vyper from 0.1.0b10 before 0.2.3 generates incorrect code for a return statement inside a for loop in an inter…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High