The vulnerability exists in the Windows implementation of asyncio.ProactorEventLoop.sock_recvfrom_into(). The method lacks a boundary check for the buffer when the nbytes parameter is specified, allowing a caller to write beyond the allocated memory. This out‑of‑bounds write is a classic buffer overflow (CWE‑787). If exploited, an attacker could corrupt memory, potentially leading to remote or local code execution, or destabilize the process with a denial‑of‑service.

The flaw affects CPython releases running on Windows. All Windows builds of CPython that use asyncio.ProactorEventLoop and call sock_recvfrom_into() are potentially vulnerable. The vulnerability is not present on non‑Windows platforms.

The CVSS score is 8.8, indicating high severity. The EPSS score is not available, and the vulnerability is not listed in CISA's KEV catalog, suggesting no publicly known exploits yet. An attacker would need to induce a vulnerable Python application to receive a socket payload larger than the specified nbytes, which typically requires remote network interaction or local privilege depending on the application's socket exposure. Because the flaw manifests as a buffer overflow, exploitation would likely provide local code execution if the attacker can exercise the vulnerable function.