Bug 2458239 (CVE-2026-5713) - CVE-2026-5713 python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process.
Summary: CVE-2026-5713 python: Python: Information disclosure and arbitrary code execu...
Keywords:
Status: NEW
Alias: CVE-2026-5713
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2458489 2458480 2458481 2458482 2458483 2458484 2458485 2458486 2458487 2458488 2458490 2458491
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-14 16:02 UTC by OSIDB Bzimport
Modified: 2026-04-23 13:33 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)

Description OSIDB Bzimport 2026-04-14 16:02:22 UTC
The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.


Note You need to log in before you can comment on or make changes to this bug.