CVE-2026-3298: Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
The method "sockrecvfrominto()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-3298?
CVE-2026-3298 has been classified with a significant severity due to the potential for out-of-bounds write vulnerabilities in Windows.
How do I fix CVE-2026-3298?
To fix CVE-2026-3298, update to the latest version of the Python asyncio.ProactorEventLoop where the vulnerability has been patched.
What systems are affected by CVE-2026-3298?
CVE-2026-3298 affects systems running Windows that utilize the Python asyncio.ProactorEventLoop.
What exploitation methods are possible with CVE-2026-3298?
Exploitation of CVE-2026-3298 could allow an attacker to write outside the intended memory bounds, potentially leading to arbitrary code execution.
Is CVE-2026-3298 related to Python's asyncio library?
Yes, CVE-2026-3298 specifically relates to the asyncio library in Python, affecting the ProactorEventLoop implementation.