CVE-2026-3298
Buffer Overflow in asyncio.ProactorEventLoop sock_recvfrom_into() (Windows
Publication date: 2026-04-21
Last updated on: 2026-04-21
Assigner: Python Software Foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| python | asyncio | From 3.13.0 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided context and resources do not include any information regarding the impact of CVE-2026-3298 on compliance with common standards and regulations such as GDPR or HIPAA.
Can you explain this vulnerability to me?
CVE-2026-3298 is a security vulnerability in Python's asyncio module, specifically in the method sock_recvfrom_into of the asyncio.ProactorEventLoop on Windows platforms.
The vulnerability occurs because the method did not perform a boundary check on the nbytes parameter, which specifies how many bytes to receive into a buffer. If nbytes was larger than the actual buffer size, this could lead to an out-of-bounds buffer write, causing buffer overflow or memory corruption.
The issue was fixed by adding a check in the underlying C implementation to ensure that the requested number of bytes does not exceed the buffer length. If it does, a ValueError is raised to prevent unsafe memory operations.
How can this vulnerability impact me? :
This vulnerability can lead to buffer overflows or memory corruption when using the asyncio.ProactorEventLoop's sock_recvfrom_into method on Windows if the nbytes parameter exceeds the buffer size.
Such buffer overflows can potentially be exploited to cause application crashes, data corruption, or even arbitrary code execution, depending on the context in which the method is used.
Because this affects asynchronous socket operations, applications relying on asyncio for network communication on Windows could be at risk if they do not handle this properly.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability is related to the Python asyncio module's method sock_recvfrom_into on Windows platforms using ProactorEventLoop. Detection involves verifying if the application uses this specific method with the nbytes parameter potentially exceeding the buffer size.
A practical detection approach is to test the behavior of sock_recvfrom_into calls with an nbytes value larger than the buffer size and observe if a ValueError is raised. This can be done by running asynchronous test scripts similar to those added in the official fix, which create UDP sockets and attempt to receive data with oversized buffers.
There are no specific network commands or system-level scans mentioned for detecting exploitation attempts. Instead, detection is best performed by code review or running test cases that verify the boundary check behavior in the Python environment.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to update Python to a version that includes the patch fixing CVE-2026-3298. The fix adds a boundary check in the asyncio.AbstractEventLoop.sock_recvfrom_into method to prevent buffer overflows by ensuring the nbytes parameter does not exceed the buffer length.
If updating is not immediately possible, review and audit any code using asyncio.ProactorEventLoop and the sock_recvfrom_into method to ensure that the nbytes parameter is never set larger than the buffer size.
Additionally, running the new asynchronous test cases that verify correct behavior can help confirm whether the environment is vulnerable or properly patched.