Call stack corruption in Vyper with complex type arguments
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
Vyper, the Python-based smart contract language, passes complex types with non-base type members, such as multi-dimensional arrays, to internal and external functions with incorrect stack handling. The stack management assumes every subtype of an array or struct occupies 32 bytes, which is not always true. As a result, a function call with a multi-dimensional array argument returns incorrect output. The source does not describe a specific attacker or required privileges.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
Description from the GitHub advisory
### Impact When we pass a multi-dimensional array (like `[[1, 2], [3, 4]]`) as an argument to internal/external functions we get incorrect output. This is due to a stack management issue, because it was assumed that the size of each subtype of an array/struct is 32, which is not always correct. Example code: ```python @internal def test_input(arr: int128[2][1], i: int128) -> (int128[2][1], int128): return arr, i @external def test_values(arr: int128[2][1], i: int128) -> (int128[2][1], int128): return self.test_input(arr, i) ``` Please see #2183 for further information ### Patches This problem was fixed in #2184, and released as a part of [`v0.2.6`](https://github.com/vyperlang/vyper/releases/tag/v0.2.6).
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | vyper (PyPI) | before 0.2.6 | 0.2.6 | Patch available | GHSA-4v7v-gqf9-ww2g |
- vyper (PyPI) Vendor— Affected before 0.2.6 Fixed in 0.2.6 Patch available GHSA-4v7v-gqf9-ww2g
Remediation
Upgrade the vyper PyPI package to version 0.2.6 or later, which fixes the issue. The sources list no fixed version for other affected ranges.
Written with Claude Haiku 5.5 from the sources below · 2026-10-29
- Fix · GHSA-4v7v-gqf9-ww2g vyper (PyPI) Fixed in 0.2.6 Advisory →
Timeline
- 2026-10-06 Threatist record created from GHSA-4v7v-gqf9-ww2g
References
Other 6
- https://github.com/vyperlang/vyper/security/advisories/GHSA-4v7v-gqf9-ww2g
- https://github.com/vyperlang/vyper/issues/2183
- https://github.com/vyperlang/vyper/pull/2184
- https://github.com/vyperlang/vyper/commit/0be02b7331e8febe79d5a4218829c72e30417a29
- https://github.com/vyperlang/vyper
- https://github.com/vyperlang/vyper/releases/tag/v0.2.6
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences