PT-2025-14539 · Crates.Io · Pyo3

Published 2025-04-02 · Updated 2025-04-02

OSV

CVSS v4.0

2.9

Low

Base vector

AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P

PyString::from object took &str arguments and forwarded them directly to the Python C API without checking for terminating nul bytes. This could lead the Python interpreter to read beyond the end of the &str data and potentially leak contents of the out-of-bounds read (by raising a Python exception containing a copy of the data including the overflow).

In PyO3 0.24.1 this function will now allocate a CString to guarantee a terminating nul bytes. PyO3 0.25 will likely offer an alternative API which takes &CStr arguments.

Fix

Out of bounds Read

Weakness Enumeration

CWE-125

Related Identifiers

GHSA-PPH8-GCV7-4QJ5

Affected Products

Pyo3

References · 5

• https://osv.dev/vulnerability/GHSA-pph8-gcv7-4qj5 · Vendor Advisory
• https://github.com/PyO3/pyo3 · Note
• https://github.com/PyO3/pyo3/pull/5008 · Note
• https://github.com/PyO3/pyo3/issues/5005 · Note
• https://rustsec.org/advisories/RUSTSEC-2025-0020.html · Note