Cpython EUVD-2026-21545

The CVSS 6.0 score reflects a network-accessible vulnerability requiring high attack complexity and low privileges (PR:L from the vector), with confidentiality impact (VI:H) but no integrity or availability impact. The authentication requirement is significant-PR:L indicates the attacker must possess valid credentials. EPSS scoring would likely be moderate given the authentication gate and high complexity requirement. This is not a remote code execution or denial-of-service risk; the threat model is data integrity across implementations. The tag 'Information Disclosure' aligns with the VI:H (confidentiality impact) flag, suggesting the vulnerability enables attackers to extract or infer information by exploiting divergent parsing behavior. Real-world risk depends on application context: if an application uses CPython to validate base64 signatures or cryptographic material and trusts the decoded output without re-validation, a malicious actor with authenticated access could craft base64 payloads that CPython accepts but a backend system processes differently, leading to authorization bypass or data leakage. Conversely, if base64 decoding is purely informational and not security-critical, risk is minimal. The high attack complexity (AC:H) and low prevalence of base64 in attack chains suggest this is a secondary vector rather than a primary exploitation target. The availability of a vendor patch further reduces real-world exposure.

An authenticated attacker on a network with high complexity constraints (e.g., requiring timing-based or state-dependent conditions) crafts a malformed base64 string that CPython's b64decode() accepts by truncating at the first padded quad, while a backend system (such as a Java or Node.js application) processes the full string according to RFC 4648. The attacker uploads the malformed base64-encoded payload as a signature or credential, exploiting the divergent parsing to bypass validation checks that rely on CPython's decoding and cause downstream systems to interpret the data differently, potentially disclosing sensitive information or allowing unauthorized access. Patching to CPython 3.13.13+ or enabling validate=True immediately blocks this attack vector.