Vyper versions from 0.1.0b4 through 0.2.x suffer a memory corruption flaw due to an incorrect stack tip pointer during internal function calls placed inside array data structures. This corruption can affect state variables, control flow, and the contents of structs, leading to predictable wrong contract behavior or potential exploitation. The weakness is classified as CWE-787, a classic out‑of‑bounds memory manipulation vulnerability.

All implementations built with Vyper 0.1.0b4 up to but excluding 0.3.0 are affected. This includes any smart contracts compiled with those compiler releases on Ethereum-compatible blockchains, regardless of the deployment environment or deployment channel, as the issue resides within the compiler itself.

The CVSS score of 8.3 indicates high severity. Although the EPSS score is not available, the lack of a KEV listing suggests no widespread exploitation has been publicly reported yet. Based on the description, it is inferred that any external transaction that triggers a contract containing nested internal calls can exploit the flaw, making the attack vector a normal contract call from any Ethereum address. The vulnerability is exploitable via normal contract calls, requiring only that the contract code contains internally nested function calls in arrays, struct literals, or raw_log topics.