CVE-2026-3298 Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
An out-of-bounds write in Python's Windows asyncio module allows attackers to cause memory corruption or execute arbitrary code.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-3298?
CVE-2026-3298 is a high-severity memory corruption vulnerability in CPython, published on 21 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.
Weakness: CWE-787
Which versions are affected by CVE-2026-3298?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.11.16, 3.12.14, 3.13.14, 3.14.5 |
python Bitnami | All versions | 3.11.16, 3.12.14, 3.13.14, 3.14.5 |
python-min Bitnami | All versions | 3.11.16, 3.12.14, 3.13.14, 3.14.5 |
How do I fix CVE-2026-3298?
Upgrade libpython to a fixed version for your release line: 3.11.16, 3.12.14, 3.13.14 or 3.14.5.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-3298 being exploited?
There is no known exploitation of CVE-2026-3298 in the wild and no public exploit code.
Sources
Also known as BIT-libpython-2026-3298, BIT-python-2026-3298, BIT-python-min-2026-3298, GHSA-3p9c-22jr-wq4x, MINI-6v47-g9m7-fc8f, MINI-fh4r-jmv4-58cj and 6 more.