{"schema":"threatline.record/2","record":{"id":"GHSA-2r3x-4mrv-mcxf","aliases":["GHSA-2r3x-4mrv-mcxf"],"summary":"Vyper: Memory corruption using function calls within tuples / nested calls","details":"### Impact\nWhen performing a function call inside a tuple or as an argument inside another function call, there is a memory corruption issue that occurs because of an incorrect pointer to the the tip of the stack.\n\nExample code:\n```python\n@internal\ndef _foo(a: uint256, b: uint256, c: uint256) -> (uint256, uint256, uint256, uint256, uint256):\n    return 1, a, b, c, 5\n\n@internal\ndef _foo2() -> uint256:\n    a: uint256[10] = [6,7,8,9,10,11,12,13,15,16]\n    return 4\n\n@external\ndef foo() -> (uint256, uint256, uint256, uint256, uint256):\n    return self._foo(2, 3, self._foo2())\n```\n\nPlease see #2186 for further information\n\n### Patches\nThis problem was fixed in #2186, and released as a part of [`v0.2.6`](https://github.com/vyperlang/vyper/releases/tag/v0.2.6).","categories":["Libraries & packages"],"product":"vyper","vendor":"","ecosystem":"pip","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-2r3x-4mrv-mcxf","source_modified_at":"2026-10-06T15:22:30Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"vyper"},"range":"< 0.2.6"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-2r3x-4mrv-mcxf","source_modified_at":"2026-10-06T15:30:03.650675920Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"vyper","ecosystem":"PyPI","purl":"pkg:pypi/vyper"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.6"}]}],"versions":["0.1.0b1","0.1.0b10","0.1.0b11","0.1.0b12","0.1.0b13","0.1.0b14","0.1.0b15","0.1.0b16","0.1.0b17","0.1.0b2","0.1.0b3","0.1.0b4","0.1.0b5","0.1.0b6","0.1.0b7","0.1.0b8","0.1.0b9","0.2.1","0.2.2","0.2.3","0.2.4","0.2.5"]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-2r3x-4mrv-mcxf","source_modified_at":"2026-10-06T15:22:30Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"ecosystem":"pip","name":"vyper"},"version":"0.2.6"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-2r3x-4mrv-mcxf","source_modified_at":"2026-10-06T15:30:03.650675920Z","fetched_at":"2026-10-23T18:42:43.628194Z","package":{"name":"vyper","ecosystem":"PyPI","purl":"pkg:pypi/vyper"},"version":"0.2.6"}],"cvss":6.9,"severity":"Medium","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-06T15:22:29Z","modified_at":"2026-10-06T15:30:03.650675920Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-2r3x-4mrv-mcxf","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-06T15:22:30Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-2r3x-4mrv-mcxf","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-06T15:30:03.650675920Z"}],"sources":["GitHub Advisory Database","OSV"],"references":[{"url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-2r3x-4mrv-mcxf","source":"GitHub Advisory Database"},{"url":"https://github.com/vyperlang/vyper/pull/2186","source":"GitHub Advisory Database"},{"url":"https://github.com/vyperlang/vyper/commit/74ba67d4bec5f8be4f05759e37d2bfb1463e0441","source":"GitHub Advisory Database"},{"url":"https://github.com/vyperlang/vyper/releases/tag/v0.2.6","source":"GitHub Advisory Database"},{"url":"https://github.com/advisories/GHSA-2r3x-4mrv-mcxf","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-06T15:30:03.650675920Z","content_hash":"064cc92a2b26b932a1f77ebfef5f5c8881db39a7cc3bc396be617105a93e7569"}}