Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-tdgk-e9p1-gqfy
Vulnerability ID VCID-tdgk-e9p1-gqfy
Aliases CVE-2026-3298
Summary The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
Status Published
Exploitability None
Weighted Severity None
Risk None
Affected and Fixed Packages Package Details
Weaknesses (1)
CWE-787 Out-of-bounds Write
System Score Found at
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2026-3298
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2026-3298
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2026-3298
epss 0.00072 https://api.first.org/data/v1/epss?cve=CVE-2026-3298
cvssv4 8.8 https://github.com/python/cpython/commit/1274766d3c29007ab77245a72abbf8dce2a9db4d
ssvc Track https://github.com/python/cpython/commit/1274766d3c29007ab77245a72abbf8dce2a9db4d
cvssv4 8.8 https://github.com/python/cpython/commit/27522b7d6e6588f03e61099dd858cd5a9314e2f2
ssvc Track https://github.com/python/cpython/commit/27522b7d6e6588f03e61099dd858cd5a9314e2f2
cvssv4 8.8 https://github.com/python/cpython/commit/95633d2aad4721e25e4dfd9f43dfb6e1edcbd741
ssvc Track https://github.com/python/cpython/commit/95633d2aad4721e25e4dfd9f43dfb6e1edcbd741
cvssv4 8.8 https://github.com/python/cpython/issues/148808
ssvc Track https://github.com/python/cpython/issues/148808
cvssv4 8.8 https://github.com/python/cpython/pull/148809
ssvc Track https://github.com/python/cpython/pull/148809
cvssv4 8.8 https://mail.python.org/archives/list/security-announce@python.org/thread/KWTPIQBOOOUNQP7UFSLBI437NJDFLA3F/
ssvc Track https://mail.python.org/archives/list/security-announce@python.org/thread/KWTPIQBOOOUNQP7UFSLBI437NJDFLA3F/
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-3298
1274766d3c29007ab77245a72abbf8dce2a9db4d https://github.com/python/cpython/commit/1274766d3c29007ab77245a72abbf8dce2a9db4d
148808 https://github.com/python/cpython/issues/148808
148809 https://github.com/python/cpython/pull/148809
27522b7d6e6588f03e61099dd858cd5a9314e2f2 https://github.com/python/cpython/commit/27522b7d6e6588f03e61099dd858cd5a9314e2f2
95633d2aad4721e25e4dfd9f43dfb6e1edcbd741 https://github.com/python/cpython/commit/95633d2aad4721e25e4dfd9f43dfb6e1edcbd741
KWTPIQBOOOUNQP7UFSLBI437NJDFLA3F https://mail.python.org/archives/list/security-announce@python.org/thread/KWTPIQBOOOUNQP7UFSLBI437NJDFLA3F/
No exploits are available.
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N Found at https://github.com/python/cpython/commit/1274766d3c29007ab77245a72abbf8dce2a9db4d
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-21T19:15:36Z/ Found at https://github.com/python/cpython/commit/1274766d3c29007ab77245a72abbf8dce2a9db4d
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N Found at https://github.com/python/cpython/commit/27522b7d6e6588f03e61099dd858cd5a9314e2f2
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-21T19:15:36Z/ Found at https://github.com/python/cpython/commit/27522b7d6e6588f03e61099dd858cd5a9314e2f2
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N Found at https://github.com/python/cpython/commit/95633d2aad4721e25e4dfd9f43dfb6e1edcbd741
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-21T19:15:36Z/ Found at https://github.com/python/cpython/commit/95633d2aad4721e25e4dfd9f43dfb6e1edcbd741
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N Found at https://github.com/python/cpython/issues/148808
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-21T19:15:36Z/ Found at https://github.com/python/cpython/issues/148808
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N Found at https://github.com/python/cpython/pull/148809
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-21T19:15:36Z/ Found at https://github.com/python/cpython/pull/148809
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N Found at https://mail.python.org/archives/list/security-announce@python.org/thread/KWTPIQBOOOUNQP7UFSLBI437NJDFLA3F/
Attack Vector (AV) Attack Complexity (AC) Attack Requirements (AT) Privileges Required (PR) User Interaction (UI) Vulnerable System Impact Confidentiality (VC) Vulnerable System Impact Integrity (VI) Vulnerable System Impact Availability (VA) Subsequent System Impact Confidentiality (SC) Subsequent System Impact Integrity (SI) Subsequent System Impact Availability (SA)

network

adjacent

local

physical

low

high

none

present

none

low

high

none

passive

active

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2026-04-21T19:15:36Z/ Found at https://mail.python.org/archives/list/security-announce@python.org/thread/KWTPIQBOOOUNQP7UFSLBI437NJDFLA3F/
Exploit Prediction Scoring System (EPSS)
Percentile 0.22085
EPSS Score 0.00072
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T16:54:15.317340+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2026/3xxx/CVE-2026-3298.json 38.6.0