CVE-2021-3177
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.
- CVSS 3.1
- 9.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - EPSS
- 24% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-25)
- CWE
- CWE-120
- Published
- Modified
- Record from
- the NVD, synced
Affected
- debian:debian_linux
- fedoraproject:fedora
- netapp:active_iq_unified_manager
- netapp:ontap_select_deploy_administration_utility
- oracle:communications_cloud_native_core_network_function_cloud_native_environment
- oracle:communications_offline_mediation_controller
- oracle:communications_pricing_design_center
- oracle:enterprise_manager_ops_center
- oracle:zfs_storage_appliance_kit
- python:python
References
- https://bugs.python.org/issue42938
- https://github.com/python/cpython/pull/24239
- https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E
- https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html
- https://lists.debian.org/debian-lts-announce/2022/02/msg00013.html