# CVE-2026-5713: Python CPython out-of-bounds read/write in remote debugging

Source: https://junglewise.ai/threats/cve-2026-5713-python-cpython-out-of-bounds-read-write-in-remote-debugging  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-14. Updated: 2026-06-10  
License: CC BY 4.0 with a link back

CVE-2026-5713 · Severity: info · CVSS 5.3 · Published 2026-04-14

A vulnerability in Python's remote debugging and profiling tools could allow a malicious process to compromise a more privileged one. If a high-privilege user attempts to debug or profile a compromised Python process, the malicious process can manipulate memory in the debugger's own process. This could lead to unauthorized data access or the execution of malicious commands within the context of the privileged user.

Technologies: [Python Software Foundation CPython](https://junglewise.ai/threats/technologies/cpython). Vendors: [Python Software Foundation](https://junglewise.ai/threats/vendors/python-software-foundation).

## Quick answers

**Is CVE-2026-5713 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-5713 being exploited in the wild.

**How severe is CVE-2026-5713?** Informational severity, with a CVSS score of 5.3, published 14 April 2026.

**Which products and versions are affected?** Python Software Foundation CPython 3.14, 3.15.

**Is there a fix for CVE-2026-5713?** A patch was published on 2026-04-13: Fix merged into CPython main branch. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-5713 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-5713?** Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) and out-of-bounds read (CWE-125) exist in the '_remote_debugging' module and 'asyncio' introspection tools. The vulnerability occurs because the debugger treats debug offset tables received from the target process as trusted. An attacker-controlled process can provide malformed offset or size tables that cause the connecting privileged process to perform out-of-bounds reads or writes when the unwinder attempts to interpret the remote process layout. Exploitation is difficult as it requires high privileges, user interaction (connecting to the malicious process), and may require multiple attempts due to ASLR-induced crashes. Patches introduce strict validation of offset tables upon loading.

## Affected products

- Python Software Foundation CPython 3.14, 3.15

## Timeline

- 2026-04-06: disclosed: Issue reported and initial PRs created.
- 2026-04-13: patched: Fix merged into CPython main branch.
- 2026-04-14: advisory: Official security announcement from Python Software Foundation.

## References

- [https://github.com/python/cpython/commit/289fd2c97a7e5aecb8b69f94f5e838ccfeee7e67](https://github.com/python/cpython/commit/289fd2c97a7e5aecb8b69f94f5e838ccfeee7e67)
- [https://github.com/python/cpython/commit/316f6265b7f9ca4ffed5346b747475ef1943f35d](https://github.com/python/cpython/commit/316f6265b7f9ca4ffed5346b747475ef1943f35d)
- [https://github.com/python/cpython/issues/148178](https://github.com/python/cpython/issues/148178)
- [https://github.com/python/cpython/pull/148187](https://github.com/python/cpython/pull/148187)
- [https://mail.python.org/archives/list/security-announce@python.org/thread/OG4RHARYSNIE22GGOMVMCRH76L5HKPLM/](https://mail.python.org/archives/list/security-announce@python.org/thread/OG4RHARYSNIE22GGOMVMCRH76L5HKPLM/)
- [http://www.openwall.com/lists/oss-security/2026/04/15/6](http://www.openwall.com/lists/oss-security/2026/04/15/6)

## Related threats

- [Python gzip/tarfile/zipfile CLI module shadowing via sys.path](https://junglewise.ai/threats/cve-2026-115791-when-tarfile-or-zipfile-command-line-interface-cli-is-used-to)
- [Python CPython quadratic complexity in xml.etree XPath index predicates](https://junglewise.ai/threats/cve-2026-6879-python-cpython-quadratic-complexity-in-xml-etree-xpath-index)
- [Python CPython CPU denial of service in html.parser.HTMLParser](https://junglewise.ai/threats/cve-2026-15308-python-cpython-cpu-denial-of-service-in-html-parser-htmlparser)
- [Python CPython improper permission preservation in tarfile.extract](https://junglewise.ai/threats/cve-2026-4360-python-cpython-improper-permission-preservation-in-tarfile-extract)
- [Python CPython infinite loop in tarfile streaming mode](https://junglewise.ai/threats/cve-2026-11972-python-cpython-infinite-loop-in-tarfile-streaming-mode)