CPython CVE-2026-3298

Windows operating system required - Linux, macOS, and Unix platforms are not vulnerable due to different asyncio event loop implementations. Application code must explicitly use asyncio.ProactorEventLoop (Windows default since Python 3.8) AND call the sock_recvfrom_into() method with the nbytes parameter AND accept network data from untrusted sources. Most Python web frameworks (Django, Flask, FastAPI) do not directly expose this low-level asyncio API, limiting exposure to custom network protocol implementations. Exploitation success further constrained by: process memory layout (requires predictable heap structure), Windows ASLR configuration (randomizes memory addresses), and DEP/NX protections (prevent direct shellcode execution from data regions). These system-level mitigations increase attack complexity beyond the CVSS AC:L rating, though a determined attacker with multiple attempts could overcome ASLR through information leaks or heap spraying techniques.

Real-world risk is moderate despite the 8.8 CVSS score due to significant exploitation constraints. CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible attack requiring no authentication, but impact is tempered by multiple factors: (1) Windows-only - eliminates Linux/Unix server deployments which dominate Python backend infrastructure, (2) Requires application code specifically using asyncio.ProactorEventLoop.sock_recvfrom_into() with the nbytes parameter - not a default code path in common frameworks, (3) Exploitation complexity depends on memory layout and ASLR/DEP mitigations in modern Windows, reducing reliable code execution scenarios. No EPSS score, KEV status, or POC availability data provided - absence of active exploitation indicators suggests this is a code-quality fix rather than an observed attack vector. SSVC assessment: exploitation status unknown, not automatable (requires specific API usage pattern), technical impact potentially high (memory corruption) but mitigated by platform and deployment constraints. Priority for organizations running Python network services on Windows with custom asyncio implementations; lower priority for typical Linux-hosted web applications.

An attacker sends a specially crafted network packet to a Windows-hosted Python application using asyncio.ProactorEventLoop for asynchronous socket operations. The application calls sock_recvfrom_into() with a fixed-size buffer but the incoming data exceeds this allocation. Without boundary validation, the method writes attacker-controlled payload beyond the buffer bounds, corrupting adjacent heap memory structures. Depending on memory layout, this could overwrite function pointers, vtable entries, or other critical data structures, potentially leading to control-flow hijacking and arbitrary code execution with the privileges of the Python process.