CVE-2026-5713

OVERVIEW CVE-2026-5713 affects Python 3.15+ profiling.sampling module and asyncio introspection capabilities (3.14+), including features like "python -m asyncio ps" and "python -m asyncio pstree." The vulnerability allows an attacker to read and write addresses in a privileged process by connecting through the remote debugging feature to a malicious or compromised Python process. SEVERITY The attack requires local network access and persistence, as an attacker must repeatedly establish connections to the target process even after crashes caused by Address Space Layout Randomization (ASLR) protections. While the attack complexity is high due to these barriers, successful exploitation could result in arbitrary code execution within a privileged process, representing a significant integrity and confidentiality impact. The CVSS score is currently unavailable, though the EPSS score of 0.00017 indicates extremely low probability of exploitation in the wild relative to other vulnerabilities. EXPLOITATION STATUS This vulnerability is not currently listed on the Known Exploited Vulnerabilities (KEV) catalog and shows no signs of active exploitation. The vulnerability remains on the inactive Hot List, with no publicly available exploit code reported. Community attention appears minimal, consistent with the low EPSS score and the technical barriers required for successful exploitation.