-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

0xCERT Security Advisory 0xCERT-2026-0186
============================================================

Advisory-ID:  0xCERT-2026-0186
Severity:     Medium
Published:    2026-10-06T15:22:23.000Z
Updated:      2026-10-08T22:46:40.151Z
Chains:       Ethereum
URL:          https://www.0xcert.com/advisory/0xCERT-2026-0186

Title: Vyper: Call stack corruption when passing complex type containing non-base type members as argument

Summary
- -------
Vyper: Call stack corruption when passing complex type containing non-base type members as argument. When we pass a multi-dimensional array (like [[1, 2], [3, 4]]) as an argument to internal/external functions we get incorrect output. This is due to a stack management issue, because it was assumed that the size of each subtype of an array/struct is 32, which is not always correct.

Details
- -------
Summary
When we pass a multi-dimensional array (like [[1, 2], [3, 4]]) as an argument to internal/external functions we get incorrect output. This is due to a stack management issue, because it was assumed that the size of each subtype of an array/struct is 32, which is not always correct.

Affected
- - vyper (pip) < 0.2.6 — fixed in 0.2.6

Severity
Medium (CVSS 6.9), as rated by the upstream advisory.

Recommended actions
- - Upgrade vyper to 0.2.6 or later

Source & attribution
This 0xCERT advisory summarises GHSA-4v7v-gqf9-ww2g from the GitHub Advisory Database: https://github.com/advisories/GHSA-4v7v-gqf9-ww2g. Details may change; refer to the original source for the authoritative record.

References
- ----------
- - https://github.com/advisories/GHSA-4v7v-gqf9-ww2g
- - https://github.com/vyperlang/vyper/security/advisories/GHSA-4v7v-gqf9-ww2g
- - https://github.com/vyperlang/vyper/issues/2183
- - https://github.com/vyperlang/vyper/pull/2184
- - https://github.com/vyperlang/vyper/commit/0be02b7331e8febe79d5a4218829c72e30417a29
- - https://github.com/vyperlang/vyper/releases/tag/v0.2.6

Verify with the 0xCERT OpenPGP key: https://www.0xcert.com/pgp.asc
Fingerprint: 5F94 3ED1 1E50 CF31 2128  C493 CCC7 D9EC 9415 723D

-----BEGIN PGP SIGNATURE-----

wrsEARYKAG0FgmrIPAcJEDe9Tbcr+ZxrRRQAAAAAABwAIHNhbHRAbm90YXRp
b25zLm9wZW5wZ3Bqcy5vcmdlPEUhT4RafW1rSqd7G1Z+EaPFa7Mx1tMRcIq7
3gz38xYhBGCkkFZbJcT5QWu27ze9Tbcr+ZxrAABD6wEAqWIdkQAhRGbPV2k3
7oWlXzptJa1VsHuZdIkVsgOlZAkBAIfpGTv1snOcAUxq/hZu3/TaiJiOzWl7
4b96243q6HAI
=4awP
-----END PGP SIGNATURE-----