HarborGuard / CVE
Back to search
HIGHCVE-2026-3298Published Modified CNA PSF

CVE-2026-3298: Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes

The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.

Metrics

CVSS v4.0
8.8
Severity
HIGH
Fixed in
3.14.5rc1
Affected Products
1

Fix available

3.14.5rc13.15.0b1
Affected packages
  • Python Software Foundation / CPython
    < 3.14.5rc1 (from 3.11.0) · < 3.15.0b1 (from 3.15.0a1)
CVSS Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N