CVE-2026-3298

CVE-2026-3298 is a buffer overflow vulnerability in Python's asyncio library affecting the sock_recvfrom_into() method of ProactorEventLoop on Windows systems only. The flaw exists due to missing boundary validation on the data buffer when the nbytes parameter is used, potentially allowing an attacker to write data beyond the allocated buffer size. Non-Windows platforms running asyncio are not affected by this vulnerability. The vulnerability presents a moderate risk profile with a FAUCET Risk Score of 51.0/100, though official CVSS metrics are not yet assigned. The nature of the out-of-bounds write could enable memory corruption attacks, though the actual attack vector complexity and real-world impact remain constrained by the asyncio-specific context and Windows-only scope. This vulnerability is not currently being actively exploited in the wild, as indicated by its absence from the Known Exploited Vulnerabilities catalog and its inactive status on threat tracking lists. The low EPSS score of 0.0005 suggests minimal current exploitation probability. Community and security attention appears limited at this time, with no publicly available exploit code reported.