Vyper versions 0.1.0b4 through 0.2.x contain a memory corruption flaw caused by an incorrect stack tip pointer when internal functions are nested inside tuples or nested calls. The bug can result in corrupted return values or misdirected arguments for external calls, potentially altering contract behavior or enabling arbitrary memory writes. The weakness is classified as CWE-787 and reflects improper size handling in memory operations.

The vulnerability affects the Vyper smart‑contract language distributed by vyperlang, specifically releases in the 0.1.0b4 to 0.2.x series. Contract developers who compile with these versions are exposed; any contracts that use nested internal function calls as tuple elements, call arguments, or within built‑in functions such as concat or ecrecover are at risk.

The CVSS score of 8.3 indicates a high severity risk. EPSS data is not available, so the current exploitation probability cannot be quantified, and the CVE is not listed in the CISA KEV catalog. Attackers would need to craft a contract that triggers the faulty stack handling, but the flaw is exploitable in any contract that employs the vulnerable constructs, giving a significant potential impact on smart‑contract integrity.