When decoding Base64 data, the interpreter stops reading after the first padded quadruple, ignoring any trailing data. The result is that applications may accept malformed or malformedly padded data that other implementations would reject. This can lead to logic errors, unintended data injection, or subtle information handling discrepancies. The vulnerability is a logic flaw (CWE‑1286) and a potential misuse of unvalidated input (CWE‑345).

The affected product is Python Software Foundation CPython. No specific version range is listed in the advisory, implying that any Python build using the standard base64 module during the time of the vulnerability is potentially affected.

The CVSS score is 6.0, indicating medium severity, while the EPSS score is below 1 %, signifying a low probability of exploitation. The vulnerability is not included in the CISA KEV catalog. Exploitation would involve supplying crafted Base64 data to an application that uses CPython’s decoding functions; the attacker would need only read or influence the decoded output, which can be readily achieved in many web or network services that decode user input.