This vulnerability in CPython arises when decoding bytes using bytes.decode("unicode_escape", error="ignore" or "replace"), leading to a use-after-free condition (CWE-416). The flaw is specific to this combination of encoding and error handlers. Users not employing "unicode_escape" encoding or error handlers are not affected. The vulnerability was published on 2025-05-15 and affects CPython versions from 0 up to 3.14.0a1. No known exploits are reported in the wild. There is no vendor advisory or patch link provided, and the vulnerability is not related to a cloud service.

The vulnerability can cause use-after-free memory corruption in CPython when decoding bytes with the specified parameters, potentially leading to crashes or undefined behavior. The CVSS 4.0 vector indicates local attack vector, high attack complexity, partial attack type, no privileges required, no user interaction, and high impact on availability. There are no reports of active exploitation.

Currently, no official patch or fix is documented. Users should avoid using bytes.decode() with the "unicode_escape" encoding combined with error handlers "ignore" or "replace". Instead, remove the error handler parameter and wrap the decode call in a try-except block to catch DecodeError exceptions. Monitor the Python Software Foundation advisories for any forthcoming official fixes.