CVE-2021-41121High· 7.5▾ TwilightMemory corruption when returning a literal struct with a private call inside of it
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
1.1%
When performing a function call inside a literal struct, there is a memory corruption issue that occurs because of an incorrect pointer to the the top of the stack.
0.3.0 / #2447
vyper < 0.3.0Upgrade to a patched release:
vyper 0.3.0Connected by shared product, vendor, weakness, or advisory.
CVE-2021-41122Medium· 4.3missing clamps for decimal args in external functions
CVE-2020-37288Medium· 3.7Vyper: Return inside for loop more than 1 level deep
CVE-2020-37286Medium· 6.5Vyper 0.1.0b4 before 0.3.0 Memory Corruption via Nested Internal Function Calls
CVE-2020-37287Medium· 5.9Vyper before 0.2.6 Call Stack Corruption via Complex Type Function Arguments
GHSA-vg88-3v92-rjx2MediumVyper: Return inside for loop more than 1 level deep
GHSA-2r3x-4mrv-mcxfMediumVyper: Memory corruption using function calls within tuples / nested calls