CVE-2020-37287

EUVD-2020-31283
Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
VulnCheckCNA
5.9 MEDIUM
NETWORK
HIGH
NONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 15.67%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
vyperlangvyper
𝑥
< 0.2.6
CNA
Common Weakness Enumeration
References
https://github.com/vyperlang/vyper/security/advisories/GHSA-4v7v-gqf9-ww2g
https://www.vulncheck.com/advisories/vyper-before-0.2.6-call-stack-corruption-via-complex-type-function-arguments