CVE-2020-37287
Medium · 5.9CVSS
5.9
EPSS
0.3%
Published
Oct 21, 2026
CISA due date
—
The record
Vyper before 0.2.6 contains a call stack corruption vulnerability that causes incorrect function outputs when complex types with non-base members are passed as arguments. Contracts passing multi-dimensional arrays or structs to internal or external functions receive corrupted values because the compiler assumed each subtype size is 32.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-57192 Asterisk is an open source private branch exchange and telephony toolkit. CWE-131
- CVE-2026-112710 A heap-based buffer overflow vulnerability exists in the Fireware OS authentication… CWE-131
- CVE-2026-112709 A heap-based buffer overflow vulnerability in the Fireware OS authentication service… CWE-131
- CVE-2026-107590 An out-of-bounds write vulnerability in the Qt QTextCodec iconv-based encoding of the Qt… CWE-131
- CVE-2026-116737 libphdi through 20260902 contains a heap out-of-bounds read vulnerability in… CWE-131
- CVE-2026-97631 EDK2 contains a vulnerability in BIOS where a user may cause “Out-of-bounds Write”… CWE-131
- CVE-2026-106574 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-131
- CVE-2026-88830 A unit confusion in BusyBox TLS Montgomery reduction buffer allocation causes a… CWE-131