CVE-2026-5713
mediumpriority · track · 0EPSS 0.001 · 3 %ileDEEURUUSEPSS · scored 2026-10-27
The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 1.7–5.6
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
affected products (15)
Products and version ranges known to be affected.
advisories (5)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-1121CPython: Schwachstelle ermöglicht Manipulation von DatenDeutsch2026-04-14csaf · cert_bundDE
Ein lokaler Angreifer kann eine Schwachstelle in CPython ausnutzen, um Daten zu manipulieren.
- BIT-libpython-2026-5713Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target2026-07-08vendor · osvUS
The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.
- BIT-python-2026-5713Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target2026-07-08vendor · osvUS
The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.
- BIT-python-min-2026-5713Out-of-bounds read/write during remote profiling and asyncio process introspection when connecting to malicious target2026-07-08vendor · osvUS
The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.
- PSF-2026-192026-04-14vendor · osvUS
The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.
also known as (8)
Other names and identifiers for this entity.
- CNNVD-202604-2909cnnvd
- EUVD-2026-22311enisa_euvd
- BDU:2026-08065fstec_bdu
- GHSA-2w92-jcqh-43jcenisa_euvd
- BIT-libpython-2026-5713osv
- BIT-python-2026-5713osv
- BIT-python-min-2026-5713osv
- PSF-2026-19osv
sources
Which sources assert this record, and when.
references (17)
External citations — patches, advisories, analysis.
- https://access.redhat.com/security/cve/cve-2026-5713cnnvd
- https://github.com/python/cpython/commit/289fd2c97a7e5aecb8b69f94f5e838ccfeee7e67cnnvd
- https://github.com/python/cpython/issues/148178cnnvd
- https://github.com/python/cpython/pull/148187cnnvd
- https://github.com/python/cpython/tagsPatchcnnvd
- https://mail.python.org/archives/list/security-announce@python.org/thread/OG4RHARYSNIE22GGOMVMCRH76L5HKPLM/cnnvd
- https://github.com/python/cpython/commit/289fd2c97a7e5aecb8b69f94f5e838ccfeee7e67enisa_euvd
- https://github.com/python/cpython/commit/316f6265b7f9ca4ffed5346b747475ef1943f35denisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan