The Vyper compiler miscompilations in parse_IfExp cause nested arrays with narrower bounds to be read using the wider type's memory layout. When a ternary expression selects the narrow array, inner arrays after the first are accessed at incorrect offsets. The result is silent corruption of stored values or unexpected transaction revert. This is a flaw in data type handling (CWE‑843).

The vulnerability affects the Vyper compiler product from vyperlang:vyper, specifically versions 0.3.8 through 0.5.0b1. Any smart contracts compiled with these releases are at risk; upgrading to a release newer than 0.5.0b1 eliminates the flaw.

The CVSS score of 6.3 indicates a medium severity. The EPSS probability is less than 1% and it is not listed in the CISA KEV catalog, suggesting a low likelihood of public exploitation. The attacker must compile a malicious contract or manipulate the compiler, so the attack vector is theoretically limited to environments that use the vulnerable compiler. Nonetheless, the potential for subtle state corruption presents a non-trivial risk to contract integrity.