CVE-2026-39892

CVE-2026-39892 is a buffer overflow vulnerability in the Python cryptography package versions 45.0.0 through 46.0.6. The flaw occurs when non-contiguous buffers are passed to APIs accepting Python buffers, such as the Hash.update() function, potentially allowing memory corruption. This vulnerability has been remediated in version 46.0.7 and later. The vulnerability carries a CVSS score of 9.8 (CRITICAL), reflecting a network-accessible attack vector with low complexity and no authentication requirements. An unauthenticated remote attacker could potentially exploit this issue without user interaction to compromise confidentiality, integrity, and availability of affected systems. The FAUCET Risk Score of 55.0/100 indicates moderate overall risk considering multiple risk factors. There is currently no evidence of active exploitation in the wild, with the vulnerability not appearing on the CISA Known Exploited Vulnerabilities (KEV) list. The Exploit Prediction Scoring System (EPSS) score of 0.00021 suggests minimal probability of near-term exploitation. This vulnerability should nonetheless be treated as priority for patching given its critical severity rating, particularly for systems handling cryptographic operations where buffer overflows could have significant consequences.