The vulnerability CVE-2026-3298 involves an out-of-bounds write in the sock_recvfrom_into() method of asyncio.ProactorEventLoop on Windows platforms in CPython versions 3.11.0 and 3.15.0a1. The method fails to properly check buffer boundaries when the nbytes parameter is used, allowing data larger than the buffer to overwrite adjacent memory. This is classified as CWE-787 (Out-of-bounds Write). The flaw is specific to Windows and does not affect other operating systems. The CVSS 4.0 base score is 8.8, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and high impact on availability. No patch or official fix has been documented as of the publication date.

An attacker can cause an out-of-bounds write in memory on affected Windows CPython environments by sending data larger than the buffer size to the sock_recvfrom_into() method. This can lead to memory corruption, potentially causing application crashes or other unpredictable behavior. The vulnerability does not require privileges or user interaction to exploit and can be triggered remotely over the network. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until an official fix is released, users should consider avoiding the use of asyncio.ProactorEventLoop's sock_recvfrom_into() method on Windows or apply any recommended workarounds from the vendor. Monitor official Python security channels for updates.