Which versions of CPython are affected by CVE-2026-3298?

CVE-2026-3298 is a memory corruption vulnerability in CPython's asyncio library on Windows that allows unauthenticated remote attackers to crash applications or execute code by sending oversized…. A patch is available.

How to fix or mitigate CVE-2026-3298?

Within 24 hours: identify all Python applications using asyncio.ProactorEventLoop on Windows systems via code review and runtime analysis. Within 7 days: apply CPython patch via GitHub PR #148809 to affected systems; upgrade to patched Python version for all Windows-based asyncio deployments. Within 30 days: validate patch deployment across production and non-production environments; conduct application testing to confirm asyncio functionality post-update.

CPython CVE-2026-3298

Q: What is the CVSS score of CVE-2026-3298?

CVE-2026-3298 has a CVSS 4.0 base score of 8.8 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.1%.

EUVD-2026-24136 HIGH

Out-of-bounds Write (CWE-787)

2026-04-21 PSF

GHSA-3p9c-22jr-wq4x

Memory Corruption Microsoft Buffer Overflow

8.8

CVSS 4.0 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Re-analysis Queued

Apr 21, 2026 - 21:22 vuln.today

cvss_changed

Analysis Generated

Apr 21, 2026 - 16:30 vuln.today

CVSS changed

Apr 21, 2026 - 15:22 NVD

8.8 (HIGH)

EUVD ID Assigned

Apr 21, 2026 - 15:00 euvd

EUVD-2026-24136

Analysis Generated

Apr 21, 2026 - 15:00 vuln.today

Patch released

Apr 21, 2026 - 15:00 nvd

Patch available

CVE Published

Apr 21, 2026 - 14:45 nvd

HIGH 8.8

DescriptionCVE.org

The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.

AnalysisAI

Out-of-bounds buffer write in CPython's asyncio.ProactorEventLoop (Windows only) allows remote attackers to trigger memory corruption via oversized network data. The sock_recvfrom_into() method lacks buffer size validation when the nbytes parameter is used, enabling writes beyond allocated memory boundaries. Patch available via GitHub PR #148809. CVSS 8.8 reflects network-accessible attack surface with no authentication required, though exploitation is platform-specific (Windows only) and requires specific asyncio usage patterns.

Technical ContextAI

This vulnerability affects CPython's asyncio module, specifically the ProactorEventLoop implementation used exclusively on Windows platforms. The ProactorEventLoop uses Windows I/O Completion Ports (IOCP) for asynchronous I/O operations, unlike Unix-based systems which use selector-based event loops. The sock_recvfrom_into() method implements zero-copy network data reception by writing directly into a caller-provided buffer. CWE-787 (Out-of-bounds Write) occurs when the method fails to validate that incoming network data does not exceed the destination buffer size specified by the nbytes parameter. This is a classic buffer overflow vulnerability where the bounds check was omitted in the data copy operation, allowing adjacent memory regions to be overwritten with attacker-controlled network payload data.

RemediationAI

Upgrade to the patched CPython version incorporating fix from GitHub pull request #148809 (https://github.com/python/cpython/pull/148809). Specific patched version number not confirmed in available data - consult the Python Security Announce mailing list thread at https://mail.python.org/archives/list/security-announce@python.org/thread/KWTPIQBOOOUNQP7UFSLBI437NJDFLA3F/ for exact release versions. If immediate patching is not feasible, implement compensating controls: (1) Audit application code for direct usage of sock_recvfrom_into() with nbytes parameter and add explicit buffer size validation before calls, (2) Deploy on Linux/Unix platforms where ProactorEventLoop is not used, eliminating exposure, (3) Enable Windows DEP (Data Execution Prevention) and ASLR system-wide to increase exploitation difficulty, though these do not eliminate the vulnerability. Note that moving to selector-based event loops (SelectorEventLoop) on Windows will change performance characteristics for high-concurrency applications. Code-level workaround trades developer effort for deployment flexibility; platform migration trades Windows-specific features for immediate risk elimination.