CVE-2026-3298 Details
Description
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
A vulnerability exists in the 'sock_recvfrom_into()' method of 'asyncio.AbstractEventLoop' on Windows. The issue arises because the method lacks a proper boundary check for the data buffer when the 'nbytes' parameter is used. This oversight can lead to an out-of-bounds buffer write if the data exceeds the buffer size. Non-Windows platforms are not affected.
Users can upgrade to the latest version of Python, where this vulnerability has been addressed, to mitigate this issue.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No CVSS 3.x data is available for this CVE.
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 21, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-787 | Out-of-bounds Write | [email protected] |
Affected Products
No affected product data is available for this CVE.
Change History
8 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 13, 2026 | CVE Modified | [email protected] |
| Aug 10, 2026 | CVE Modified | [email protected] |
| Aug 5, 2026 | CVE Modified | [email protected] |
| Jul 31, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Apr 21, 2026 | CVE Modified | [email protected] |
| Apr 21, 2026 | New CVE Received | [email protected] |