GHSA-47qc-857f-7w7f
PyO3 has type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature
PyO3 0.28.1 added support for #[pyclass(extends=PyList)] struct NativeSub (and other native types) when targeting Python 3.12 and up with the abi3 feature.
It was discovered that subclasses of such classes would use the type of the subclass when attempting to access to data of NativeSub contained within Python objects, amounting to memory corruption.
PyO3 0.28.2 fixed the issue by using the type of (e.g.) NativeSub correctly.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
What each source reports
GitHub Advisories Score used
PyO3 has type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature
PyO3 0.28.1 added support for #[pyclass(extends=PyList)] struct NativeSub (and other native types) when targeting Python 3.12 and up with the abi3 feature.
It was discovered that subclasses of such classes would use the type of the subclass when attempting to access to data of NativeSub contained within Python objects, amounting to memory corruption.
PyO3 0.28.2 fixed the issue by using the type of (e.g.) NativeSub correctly.
- Record
GHSA-47qc-857f-7w7f- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-843
- Updated
- 2026-11-02
OSV
PyO3 has type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature
PyO3 0.28.1 added support for #[pyclass(extends=PyList)] struct NativeSub (and other native types) when targeting Python 3.12 and up with the abi3 feature.
It was discovered that subclasses of such classes would use the type of the subclass when attempting to access to data of NativeSub contained within Python objects, amounting to memory corruption.
PyO3 0.28.2 fixed the issue by using the type of (e.g.) NativeSub correctly.
- Record
GHSA-47qc-857f-7w7f- CVSS 4.0
- 7.2 High
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U - Weakness
- CWE-843
- Updated
- 2026-11-02
OSVRUSTSEC-2026-0013No score
Type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature targeting Python 3.12 and up
PyO3 0.28.1 added support for #[pyclass(extends=PyList)] struct NativeSub (and other native types) when targeting Python 3.12 and up with the abi3 feature.
It was discovered that subclasses of such classes would use the type of the subclass when attempting to access to data of NativeSub contained within Python objects, amounting to memory corruption.
PyO3 0.28.2 fixed the issue by using the type of (e.g.) NativeSub correctly.
- Record
RUSTSEC-2026-0013- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
pyo3crates.io | 0.28.0 up to 0.28.2 | 0.28.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-47qc-857f-7w7f is a high vulnerability (CVSS 7.2) in pyo3, published February 18, 2026. No source lists public exploit code. Fixed in pyo3 0.28.2.