CVE-2026-3298 json
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
published 2026-04-21 6 mo ago modified 2026-10-26 13 d ago also BIT-libpython-2026-3298 , BIT-python-2026-3298 , BIT-python-min-2026-3298 , EUVD-2026-24136
- cvss
- 8.8
- version 4.0, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.4%
- EPSS 0.4% chance of exploitation in 30 days, percentile 33%
- public exploits
- 0
- none known
Summary
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
Patch / fix
- bitnami libpython 3.11.16, 3.12.14, 3.13.14, 3.14.5
- bitnami python 3.11.16, 3.12.14, 3.13.14, 3.14.5
- bitnami python-min 3.11.16, 3.12.14, 3.13.14, 3.14.5
- Python Software Foundation CPython 3.11.16, 3.12.14, 3.13.14, 3.14.5rc1, 3.15.0b1
- github.com/python/cpython@1274766 commit
- github.com/python/cpython@27522b7 commit
- github.com/python/cpython@95633d2 commit
- github.com/python/cpython@6c8b85b commit
- github.com/python/cpython@f5ca387 commit
- github.com/python/cpython#148809 pull request
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 6 mo ago
Exploit prediction
0.39% chance of exploitation in the next 30 days, higher than 33% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N |
| CNA | 4.0 | 8.8 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| bitnami | libpython | <3.11.16 >=3.12.0, <3.12.14 >=3.13.0, <3.13.14 >=3.14.0, <3.14.5 |
3.11.16 3.12.14 3.13.14 3.14.5 |
| bitnami | python | <3.11.16 >=3.12.0, <3.12.14 >=3.13.0, <3.13.14 >=3.14.0, <3.14.5 |
3.11.16 3.12.14 3.13.14 3.14.5 |
| bitnami | python-min | <3.11.16 >=3.12.0, <3.12.14 >=3.13.0, <3.13.14 >=3.14.0, <3.14.5 |
3.11.16 3.12.14 3.13.14 3.14.5 |
Affected products
- Python Software Foundation CPython
Classification
- Weakness
-
- CWE-787 Out-of-bounds Write
References
-
github.com
/python/cpython/pull/148809
patch, web
-
github.com
/python/cpython/commit/1274766d3c29007ab77245a72abbf8dce2a9db4d
patch, web
-
github.com
/python/cpython/commit/27522b7d6e6588f03e61099dd858cd5a9314e2f2
patch, web
-
github.com
/python/cpython/commit/95633d2aad4721e25e4dfd9f43dfb6e1edcbd741
patch, web
-
github.com
/python/cpython/commit/6c8b85b3f1d83d5697ec19880960e1eacee56688
patch, web
-
github.com
/python/cpython/commit/f5ca38739241fe7a40a4b116d5a8a1364dd6fea7
patch, web
-
mail.python.org
/archives/list/security-announce@python.org/thread/KWTPIQBOOOUNQP7UFSLBI437NJDFLA3F/
vendor-advisory, web
-
github.com
/python/cpython/issues/148808
issue-tracking, web
-
nvd.nist.gov
/vuln/detail/CVE-2026-3298
web
Sources
- CVE List CVE-2026-3298
- NVD CVE-2026-3298
- OSV BIT-libpython-2026-3298
- OSV BIT-python-2026-3298
- OSV BIT-python-min-2026-3298
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.