A buffer overflow condition exists in the PyCA Cryptography Python package when a non‑contiguous buffer is supplied to APIs that accept Python buffers, such as the Hash.update() method. The affected code erroneously treats the non‑contiguous buffer as contiguous, allowing an attacker who can craft such a buffer to corrupt memory. This weakness is identified as CWE‑119.

The vulnerability affects versions of PyCA Cryptography ranging from 45.0.0 up to, but not including, 46.0.7. Any Python application using a pre‑46.0.7 release and invoking cryptographic functions with non‑contiguous buffers is potentially vulnerable.

The CVSS base score of 6.9 indicates moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would require an attacker to supply a crafted non‑contiguous buffer to a vulnerable API, which may be feasible in contexts where input is controllable. The risk is moderate and should be mitigated by updating the library.