This vulnerability in CPython 3.14.0 and later affects the profiling.sampling module and asyncio introspection capabilities used with remote debugging. It allows a local attacker with high privileges to repeatedly connect to a privileged Python process and perform out-of-bounds memory reads and writes due to a stack-based buffer overflow (CWE-121) and related memory access issues (CWE-125). The attack requires persistent connection attempts and is mitigated somewhat by address space layout randomization (ASLR) and instability of the attacking process. No vendor advisory or patch has been published yet.

Successful exploitation could allow a local attacker with high privileges to read and write memory addresses in a privileged Python process, potentially leading to memory corruption or privilege escalation. However, exploitation is difficult due to the need for repeated connections and the likelihood of crashing the attacking process. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is available, avoid enabling or exposing the remote debugging feature in privileged Python processes, and limit access to trusted users only.