{"id":"GHSA-4v7v-gqf9-ww2g","aliases":[],"url":"https://o3.security/vulnerability/GHSA-4v7v-gqf9-ww2g","summary":"Vyper: Call stack corruption when passing complex type containing non-base type members as argument","details":"### Impact\nWhen we pass a multi-dimensional array (like `[[1, 2], [3, 4]]`) as an argument to internal/external functions we get incorrect output. This is due to a stack management issue, because it was assumed that the size of each subtype of an array/struct is 32, which is not always correct.\n\nExample code:\n```python\n@internal\ndef test_input(arr: int128[2][1], i: int128) -> (int128[2][1], int128):\n    return arr, i\n\n@external\ndef test_values(arr: int128[2][1], i: int128) -> (int128[2][1], int128):\n    return self.test_input(arr, i)\n```\n\nPlease see #2183 for further information\n\n### Patches\nThis problem was fixed in #2184, and released as a part of [`v0.2.6`](https://github.com/vyperlang/vyper/releases/tag/v0.2.6).","published":"2026-10-06T15:22:23Z","modified":"2026-10-06T15:30:03.646574259Z","cvss":null,"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"vyper","fixedVersion":"0.2.6"}],"fix":{"url":"https://github.com/vyperlang/vyper/pull/2184","label":"vyperlang/vyper#2184"},"references":[{"type":"WEB","url":"https://github.com/vyperlang/vyper/security/advisories/GHSA-4v7v-gqf9-ww2g"},{"type":"WEB","url":"https://github.com/vyperlang/vyper/issues/2183"},{"type":"WEB","url":"https://github.com/vyperlang/vyper/pull/2184"},{"type":"WEB","url":"https://github.com/vyperlang/vyper/commit/0be02b7331e8febe79d5a4218829c72e30417a29"},{"type":"PACKAGE","url":"https://github.com/vyperlang/vyper"},{"type":"WEB","url":"https://github.com/vyperlang/vyper/releases/tag/v0.2.6"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-06T15:30:03.646574259Z"}}