PT-2026-33988 · Python · Python

Ggautomaton + 2 · CVE-2026-3298 · Published 2026-04-21 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v4.0

8.8

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Python (affected versions not specified)

Description On Windows systems, the sock recvfrom into() function within asyncio.ProacterEventLoop lacks a boundary check for the data buffer when the nbytes parameter is used. This flaw allows an out-of-bounds buffer write if the received network data exceeds the buffer size, which may lead to memory corruption, system crashes, or potential remote code execution.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

BIT-LIBPYTHON-2026-3298

BIT-PYTHON-2026-3298

BIT-PYTHON-MIN-2026-3298

CVE-2026-3298

PSF-2026-20

Affected Products

Python

References · 23

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/3xxx/CVE-2026-3298.json · Exploit
• https://github.com/python/cpython/commit/1274766d3c29007ab77245a72abbf8dce2a9db4d · Patch
• https://github.com/python/cpython/pull/148809 · Patch
• https://github.com/python/cpython/commit/95633d2aad4721e25e4dfd9f43dfb6e1edcbd741 · Patch
• https://github.com/python/cpython/commit/27522b7d6e6588f03e61099dd858cd5a9314e2f2 · Patch
• https://osv.dev/vulnerability/BIT-libpython-2026-3298 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-3298 · Security Note
• https://mail.python.org/archives/list/[e-mail]/thread/KWTPIQBOOOUNQP7UFSLBI437NJDFLA3F · Vendor Advisory
• https://osv.dev/vulnerability/BIT-python-2026-3298 · Vendor Advisory
• https://osv.dev/vulnerability/PSF-2026-20 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-3298 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-python-min-2026-3298 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-3298 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2026-3298 · Security Note
• https://osv.dev/vulnerability/CVE-2026-3298 · Vendor Advisory