Technical impact
A use‑after‑free flaw exists in CPython’s unicode_escape decoder when the error handler parameter is set to "ignore" or "replace". The bug can corrupt memory in the interpreter, potentially leading to application crashes or, if an attacker can supply crafted input, to more severe consequences such as arbitrary code execution. The CVSS score of 5.9 reflects a moderate impact and the flaw is a classic use‑after‑free. The description does not indicate remote code execution in normal usage, but the underlying weakness remains a serious memory corruption risk.
Affected Systems
The vulnerability affects CPython implementations from the Python Software Foundation. No specific versions are listed in the CNA data; all releases that allow the use of bytes.decode("unicode_escape", error="ignore|replace") are potentially impacted until a patch is released.
Risk and Exploitability
The EPSS score is below 1%, indicating a very low likelihood of exploitation in the wild at this time. The CVSS score shows moderate severity, and the vulnerability is not currently listed in the CISA KEV catalog. Most likely the attack vector requires code that runs in the context of the vulnerable Python interpreter and supplies input that triggers the UnicodeDecodeError path. In typical deployments an attacker would need to supply crafted byte sequences that hit the error handler logic. Given the low EPSS and lack of public exploit activity, the immediate risk to most systems is low, although the memory corruption remains a serious concern if the flaw is exercised.
Debian DLA
EUVD
Ubuntu USN