Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Pyth

Summary

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Timeline

1. Jan 19, 2021, 12:00 AM UTCCVE published
2. Dec 18, 2025, 3:03 PM UTCCISA SSVC assessment

   Exploitation: poc · Automatable: yes · Technical impact: total

3. Oct 14, 2026, 9:45 AM UTCRecord last updated
4. Oct 22, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• libpythonBitnami

  fixed in 3.6.13; From 3.7.0 · fixed in 3.7.10; From 3.8.0 · fixed in 3.8.8; From 3.9.0 · fixed in 3.9.2

• pythonBitnami

  fixed in 3.6.13; From 3.7.0 · fixed in 3.7.10; From 3.8.0 · fixed in 3.8.8; From 3.9.0 · fixed in 3.9.2

• python-minBitnami

  fixed in 3.6.13; From 3.7.0 · fixed in 3.7.10; From 3.8.0 · fixed in 3.8.8; From 3.9.0 · fixed in 3.9.2

References 25