Executive brief
A vulnerability in Python's remote debugging and profiling tools could allow a malicious process to compromise a more privileged one. If a high-privilege user attempts to debug or profile a compromised Python process, the malicious process can manipulate memory in the debugger's own process. This could lead to unauthorized data access or the execution of malicious commands within the context of the privileged user.
Technical details
A stack-based buffer overflow (CWE-121) and out-of-bounds read (CWE-125) exist in the '_remote_debugging' module and 'asyncio' introspection tools. The vulnerability occurs because the debugger treats debug offset tables received from the target process as trusted. An attacker-controlled process can provide malformed offset or size tables that cause the connecting privileged process to perform out-of-bounds reads or writes when the unwinder attempts to interpret the remote process layout. Exploitation is difficult as it requires high privileges, user interaction (connecting to the malicious process), and may require multiple attempts due to ASLR-induced crashes. Patches introduce strict validation of offset tables upon loading.
Affected products
- Python Software Foundation CPython 3.14, 3.15
Timeline
- 2026-04-06: disclosed: Issue reported and initial PRs created.
- 2026-04-13: patched: Fix merged into CPython main branch.
- 2026-04-14: advisory: Official security announcement from Python Software Foundation.
References
- https://github.com/python/cpython/commit/289fd2c97a7e5aecb8b69f94f5e838ccfeee7e67
- https://github.com/python/cpython/commit/316f6265b7f9ca4ffed5346b747475ef1943f35d
- https://github.com/python/cpython/issues/148178
- https://github.com/python/cpython/pull/148187
- https://mail.python.org/archives/list/security-announce@python.org/thread/OG4RHARYSNIE22GGOMVMCRH76L5HKPLM/
- http://www.openwall.com/lists/oss-security/2026/04/15/6