CVE-2026-3446

CVE-2026-3446 is a base64 decoding vulnerability affecting implementations that use base64.b64decode() or related functions. The flaw causes the decoding process to prematurely terminate after the first padded quad, regardless of additional data present in the input stream. This can result in incomplete data processing and potential interoperability issues when the same base64 string is decoded by other implementations with stricter validation. The vulnerability carries a FAUCET Risk Score of 43.0/100 and an exceptionally low EPSS score of 0.00025, indicating minimal real-world exploit probability. While specific CVSS metrics are unavailable, the vulnerability fundamentally represents an inconsistent data handling issue rather than a direct attack vector. The primary risk lies in data being silently truncated during decoding rather than in confidentiality, integrity, or availability breaches. There is no evidence of active exploitation, and the vulnerability is not listed on the CISA Known Exploited Vulnerabilities catalog. Community attention remains low, consistent with the low EPSS score and inactive hot list status. Mitigation is straightforward, requiring users to enable the "validate=True" parameter in base64 decoding functions to enforce stricter processing standards.