CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
- Record
CVE-2026-3298- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2026-24136
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
- Record
EUVD-2026-24136- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-3p9c-22jr-wq4x
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a...
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
- Record
GHSA-3p9c-22jr-wq4x- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-787
- Updated
- 2026-11-02
NVD
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
- Record
CVE-2026-3298- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Weakness
- CWE-787
- Updated
- 2026-11-02
OSV
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
- Record
CVE-2026-3298- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - Weakness
- CWE-787
- Updated
- 2026-11-04
OSVUBUNTU-CVE-2026-3298
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
- Record
UBUNTU-CVE-2026-3298- CVSS 4.0
- 8.8 High
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVBIT-libpython-2026-3298 No score
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
- Record
BIT-libpython-2026-3298- Updated
- 2026-11-02
OSVBIT-python-2026-3298 No score
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
- Record
BIT-python-2026-3298- Updated
- 2026-11-02
OSVBIT-python-min-2026-3298 No score
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
- Record
BIT-python-min-2026-3298- Updated
- 2026-11-02
OSVPSF-0000-CVE-2026-3298 No score
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
- Record
PSF-0000-CVE-2026-3298- Updated
- 2026-11-02
OSVPSF-2026-20 No score
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
- Record
PSF-2026-20- Updated
- 2026-11-02
OSVROOT-OS-ALPINE-320-CVE-2026-3298 No score
CVE-2026-3298 in python3 - Patched by Root
Root has patched CVE-2026-3298 in the python3 package for Root:Alpine:3.20. Multiple fixed versions available.
- Record
ROOT-OS-ALPINE-320-CVE-2026-3298- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
libpythonBitnami |
before 3.11.16, 3.12.0 up to 3.12.14, 3.13.0 up to 3.13.14, 3.14.0 up to 3.14.5 | 3.11.163.12.143.13.143.14.5 |
pythonBitnami |
before 3.11.16, 3.12.0 up to 3.12.14, 3.13.0 up to 3.13.14, 3.14.0 up to 3.14.5 | 3.11.163.12.143.13.143.14.5 |
python-minBitnami |
before 3.11.16, 3.12.0 up to 3.12.14, 3.13.0 up to 3.13.14, 3.14.0 up to 3.14.5 | 3.11.163.12.143.13.143.14.5 |
python3Root:Alpine:3.20 |
before 3.12.13-r00072 | 3.12.13-r000723.12.13-r000733.12.13-r000743.12.13-r000753.12.13-r00076 |
rootio-python3Root:Alpine:3.20 |
before 3.12.13-r00072 | 3.12.13-r000723.12.13-r000733.12.13-r000743.12.13-r000753.12.13-r00076 |
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | OSV | |
| affected | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-3298 is a high vulnerability (CVSS 8.8) in Python Software Foundation Cpython, published April 21, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.39%, the 33rd percentile. Fixed in libpython 3.11.16.
References
github.com/python/cpython/pull/148809
mail.python.org/archives/list/[email protected]/thread/KWTPIQBOOOUNQP7UFSLBI437NJDFLA3F
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-3298
ubuntu.com/security/CVE-2026-3298
cve.org/CVERecord?id=CVE-2026-3298