Vyper before version 0.2.6 miscalculates the size of complex type elements, treating each subgroup as if it occupies exactly 32 bytes. This assumption causes stack corruption when a contract passes multi‑dimensional arrays or structs with non‑base members to internal or external functions. The corrupted stack results in the called function receiving malformed data, leading to wrong outputs and potential inadvertent state changes. The weakness is an instance of an incorrect assumption about memory layout (CWE‑131).

All individuals or organizations that compile contracts with Vyper earlier than 0.2.6 and deploy them to any Ethereum‑compatible blockchain are affected. This includes any contract that accepts complex type arguments—such as multi‑dimensional arrays or structs—in either internal or external function calls. The impact is confined to the affected contract, but any actor capable of interacting with the contract can trigger the mis‑behaviour.

The CVSS score of 8.2 classifies the flaw as high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, indicating no publicly documented exploits. Nevertheless, the exploit path is straightforward: an attacker only needs to supply specially crafted complex type data through ordinary contract interaction, without requiring privileged access or out‑of‑band techniques. Given the severity and ease of exploitation, the vulnerability poses a significant risk to contract integrity.