High 8.8Published Apr 21, 2026

CVE-2026-3298Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes

Updated under an hour ago (Oct 26, 2026, 5:10 PM ET)

Does this affect you?

It affects Python Software Foundation CPython. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Python Software Foundation CPython

Exploited in the last 30 days

The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.

CVSS: 8.8 HIGH (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:N/SI:N/SA:N
Weakness (CWE): CWE-787
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: PSF
NVD analysis: Awaiting Analysis
Record last updated: Aug 12, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Python Software Foundation CPython python_software_foundation:cpython (from the name)	before 3.11.16; from 3.12.0 before 3.12.14; from 3.13.0 before 3.13.14; from 3.14.0a1 before 3.14.5rc1; from 3.15.0a1 before 3.15.0b1	CNA record

References

References

https://github.com/python/cpython/pull/148809	patch
https://github.com/python/cpython/issues/148808	issue-tracking
https://mail.python.org/archives/list/security-announce@python.org/thread/KWTPIQBOOOUNQP7UFSLBI437NJDFLA3F/	vendor-advisory
https://github.com/python/cpython/commit/1274766d3c29007ab77245a72abbf8dce2a9db4d	patch
https://github.com/python/cpython/commit/27522b7d6e6588f03e61099dd858cd5a9314e2f2	patch
https://github.com/python/cpython/commit/95633d2aad4721e25e4dfd9f43dfb6e1edcbd741	patch
https://github.com/python/cpython/commit/6c8b85b3f1d83d5697ec19880960e1eacee56688	patch
https://github.com/python/cpython/commit/f5ca38739241fe7a40a4b116d5a8a1364dd6fea7	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.