All vulnerabilities
GHSA-2r3x-4mrv-mcxf

Vyper: Memory corruption using function calls within tuples / nested calls

vyperpipLibraries & packages
Open in ThreatlineRecord JSON
CVSS
6.9Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in0.2.6Fixed versionGitHub
Published6 Oct 2026Updated 6 Oct 2026GitHub

What fixes it

  • 0.2.6vyper, pipGitHub
  • 0.2.6vyper, PyPIOSVpip install "vyper>=0.2.6"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

When performing a function call inside a tuple or as an argument inside another function call, there is a memory corruption issue that occurs because of an incorrect pointer to the the tip of the stack.

Example code:

@internal
def _foo(a: uint256, b: uint256, c: uint256) -> (uint256, uint256, uint256, uint256, uint256):
    return 1, a, b, c, 5

@internal
def _foo2() -> uint256:
    a: uint256[10] = [6,7,8,9,10,11,12,13,15,16]
    return 4

@external
def foo() -> (uint256, uint256, uint256, uint256, uint256):
    return self._foo(2, 3, self._foo2())

Please see #2186 for further information

Patches

This problem was fixed in #2186, and released as a part of [v0.2.6](https://github.com/vyperlang/vyper/releases/tag/v0.2.6).

Text from GitHub Advisory Database

Affected versions 24

  • vyper, pip< 0.2.6GitHub
  • vyper, PyPIfrom first release, fixed in 0.2.6OSV
  • vyper, PyPI0.1.0b1OSV
  • vyper, PyPI0.1.0b10OSV
  • vyper, PyPI0.1.0b11OSV
  • vyper, PyPI0.1.0b12OSV
  • vyper, PyPI0.1.0b13OSV
  • vyper, PyPI0.1.0b14OSV
  • vyper, PyPI0.1.0b15OSV
  • vyper, PyPI0.1.0b16OSV
  • vyper, PyPI0.1.0b17OSV
  • vyper, PyPI0.1.0b2OSV
  • vyper, PyPI0.1.0b3OSV
  • vyper, PyPI0.1.0b4OSV
  • vyper, PyPI0.1.0b5OSV
  • vyper, PyPI0.1.0b6OSV
  • vyper, PyPI0.1.0b7OSV
  • vyper, PyPI0.1.0b8OSV
  • vyper, PyPI0.1.0b9OSV
  • vyper, PyPI0.2.1OSV
  • vyper, PyPI0.2.2OSV
  • vyper, PyPI0.2.3OSV
  • vyper, PyPI0.2.4OSV
  • vyper, PyPI0.2.5OSV

References 5