HIGHCVE-2026-3298Published Modified CNA PSF
CVE-2026-3298: Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
Metrics
- CVSS v4.0
- 8.8
- Severity
- HIGH
- Fixed in
- 3.14.5rc1
- Affected Products
- 1
Affected packages
- Python Software Foundation / CPython< 3.14.5rc1 (from 3.11.0) · < 3.15.0b1 (from 3.15.0a1)
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N