---
id: CVE-2026-3298
title: >-
  The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows
  only) was missing a boundary check for the data buffer when using nbytes
  parameter
summary: >-
  The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows
  only) was missing a boundary check for the data buffer when using nbytes
  parameter. This allowed for an out-of-bounds buffer write if data was larger
  than the buff…
severity: none
cwe:
  - CWE-787
published: '2026-04-21'
updated: '2026-07-31'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-3298'
references:
  - url: >-
      https://github.com/python/cpython/commit/1274766d3c29007ab77245a72abbf8dce2a9db4d
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/27522b7d6e6588f03e61099dd858cd5a9314e2f2
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/95633d2aad4721e25e4dfd9f43dfb6e1edcbd741
    label: cna@python.org
  - url: 'https://github.com/python/cpython/issues/148808'
    label: cna@python.org
  - url: 'https://github.com/python/cpython/pull/148809'
    label: cna@python.org
  - url: >-
      https://mail.python.org/archives/list/security-announce@python.org/thread/KWTPIQBOOOUNQP7UFSLBI437NJDFLA3F/
    label: cna@python.org
tags:
  - nvd
epss: 0.00604
epssPercentile: 0.46571
ingestedAt: '2026-07-31T22:04:40.456Z'
---

## Overview

The method "sock_recvfrom_into()" of "asyncio.ProacterEventLoop" (Windows only) was missing a boundary check for the data buffer when using nbytes parameter. This allowed for an out-of-bounds buffer write if data was larger than the buffer size. Non-Windows platforms are not affected.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.