EUVD-2026-24136
GHSA-3p9c-22jr-wq4x
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from Vendor (PSF) · only source for this CVE.
CVSS VectorVendor: PSF
Lifecycle Timeline
7DescriptionCVE.org
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
AnalysisAI
Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memory corruption via oversized network data. The sock_recvfrom_into() method lacks buffer size validation when the nbytes parameter is used, enabling writes beyond allocated memory boundaries. Patch available via GitHub PR #148809. CVSS 8.8 reflects network-accessible attack surface with no authentication required, though exploitation is platform-specific (Windows only) and requires specific asyncio usage patterns.
Technical ContextAI
This vulnerability affects CPython's asyncio module, specifically the ProactorEventLoop implementation used exclusively on Windows platforms. The ProactorEventLoop uses Windows I/O Completion Ports (IOCP) for asynchronous I/O operations, unlike Unix-based systems which use selector-based event loops. The sock_recvfrom_into() method implements zero-copy network data reception by writing directly into a caller-provided buffer. CWE-787 (Out-of-bounds Write) occurs when the method fails to validate that incoming network data does not exceed the destination buffer size specified by the nbytes parameter. This is a classic buffer overflow vulnerability where the bounds check was omitted in the data copy operation, allowing adjacent memory regions to be overwritten with attacker-controlled network payload data.
RemediationAI
Upgrade to the patched CPython version incorporating fix from GitHub pull request #148809 (https://github.com/python/cpython/pull/148809). Specific patched version number not confirmed in available data - consult the Python Security Announce mailing list thread at https://mail.python.org/archives/list/security-announce@python.org/thread/KWTPIQBOOOUNQP7UFSLBI437NJDFLA3F/ for exact release versions. If immediate patching is not feasible, implement compensating controls: (1) Audit application code for direct usage of sock_recvfrom_into() with nbytes parameter and add explicit buffer size validation before calls, (2) Deploy on Linux/Unix platforms where ProactorEventLoop is not used, eliminating exposure, (3) Enable Windows DEP (Data Execution Prevention) and ASLR system-wide to increase exploitation difficulty, though these do not eliminate the vulnerability. Note that moving to selector-based event loops (SelectorEventLoop) on Windows will change performance characteristics for high-concurrency applications. Code-level workaround trades developer effort for deployment flexibility; platform migration trades Windows-specific features for immediate risk elimination.
CPython decompression modules (lzma, bz2, gzip) allow memory corruption via use-after-free when decompressor instances a
Denial of service in CPython's tarfile module allows remote attackers to trigger an infinite loop by supplying a crafted
Stack-based buffer overflow in CPython's bz2.BZ2Decompressor allows remote attackers to crash Python applications by sen
Path traversal in CPython's tarfile module allows a crafted tar archive to bypass the 'data' and 'tar' extraction filter
Command injection in CPython's webbrowser.open() API bypasses previous CVE-2026-4519 mitigation via specially crafted UR
The webbrowser.open() API in CPython accepts URLs with leading dashes, which certain web browsers interpret as command-l
Path traversal in CPython's tarfile module allows malicious tar archives to bypass the data_filter safety mechanism and
CPython's tarfile module on POSIX platforms creates empty directories outside the intended extraction destination when p
XML parsers in CPython's xml.parsers.expat and xml.etree.ElementTree modules use insufficient entropy for Expat hash-flo
Denial-of-service via quadratic algorithmic complexity in CPython's unicodedata.normalize() affects all CPython versions
Integrity bypass in CPython's stringprep module causes divergent domain name normalization when processing international
Credential disclosure in Python's urllib.request HTTPPasswordMgr class family enables scheme-downgrade attacks that expo
Same weakness CWE-787 – Out-of-bounds Write
View allSame technique Memory Corruption
View allShare
External POC / Exploit Code
Leaving vuln.today