NumPy is a foundational numerical computing library that, despite its narrow product scope, is embedded across vast amounts of scientific computing infrastructure, data-analysis pipelines, and machine-learning frameworks. Vulnerabilities affecting the library skew toward serious outcomes, with an elevated share reaching critical severity, and they recur through weakness classes including classic buffer overflows, deserialization of untrusted data, improper input validation, and link-following issues that reflect both the memory-unsafe nature of its C-based implementation and its role parsing and processing external data. Defenders should treat NumPy advisories as broadly applicable, since remediation often depends on downstream projects rebuilding their dependencies; live severity and exploitation figures are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Numpy over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2019-6446CRITICAL An issue was discovered in NumPy before 1.16.3. It uses the pickle Python module unsafely, which allows remote attackers to execute arbitrary code via a crafted serialized object, | Jan 16, 2019 | 9.8 | 41 | NO | NO |
CVE-2017-12852HIGH The numpy.pad function in Numpy 1.13.1 and older versions is missing input validation. An empty list or ndarray will stick into an infinite loop, which can allow attackers to cause | Aug 15, 2017 | 7.5 | 25 | NO | NO |
CVE-2021-34141MEDIUM An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. N | Dec 17, 2021 | 5.3 | 21 | NO | NO |
CVE-2021-41496MEDIUM Buffer overflow in the array_from_pyobj function of fortranobject.c in NumPy < 1.19, which allows attackers to conduct a Denial of Service attacks by carefully constructing an arra | Dec 17, 2021 | 5.5 | 20 | NO | NO |
CVE-2021-41495MEDIUM Null Pointer Dereference vulnerability exists in numpy.sort in NumPy < and 1.19 in the PyArray_DescrNew function due to missing return-value validation, which allows attackers to | Dec 17, 2021 | 5.3 | 20 | NO | NO |
CVE-2021-33430MEDIUM A Buffer Overflow vulnerability exists in NumPy 1.9.x in the PyArray_NewFromDescr_int function of ctors.c when specifying arrays of large dimensions (over 32) from Python code, whi | Dec 17, 2021 | 5.3 | 20 | NO | NO |
CVE-2014-1859MEDIUM (1) core/tests/test_memmap.py, (2) core/tests/test_multiarray.py, (3) f2py/f2py2e.py, and (4) lib/tests/test_io.py in NumPy before 1.8.1 allow local users to write to arbitrary fil | Jan 8, 2018 | 5.5 | 20 | NO | NO |
CVE-2014-1858MEDIUM __init__.py in f2py in NumPy before 1.8.1 allows local users to write to arbitrary files via a symlink attack on a temporary file. | Jan 8, 2018 | 5.5 | 17 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Numpy.
Media articles that mention a CVE ID that affects a product developed by Numpy — matched by CVE ID, not by vendor name.