Bug 2458239 (CVE-2026-5713) - CVE-2026-5713 python: Python: Information disclosure and arbitrary code execution via remote debugging with a malicious process.
Summary: CVE-2026-5713 python: Python: Information disclosure and arbitrary code execu...
Keywords:
Status: NEW
Alias: CVE-2026-5713
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2458480 2458481 2458482 2458483 2458484 2458485 2458486 2458487 2458488 2458489 2458490 2458491
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-04-14 16:02 UTC by OSIDB Bzimport
Modified: 2026-05-19 17:59 UTC (History)
5 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:19019 0 None None None 2026-05-19 13:02:39 UTC
Red Hat Product Errata RHSA-2026:19176 0 None None None 2026-05-19 17:59:14 UTC

Description OSIDB Bzimport 2026-04-14 16:02:22 UTC
The "profiling.sampling" module (Python 3.15+) and "asyncio introspection capabilities" (3.14+, "python -m asyncio ps" and "python -m asyncio pstree") features could be used to read and write addresses in a privileged process if that process connected to a malicious or "infected" Python process via the remote debugging feature. This vulnerability requires persistently and repeatedly connecting to the process to be exploited, even after the connecting process crashes with high likelihood due to ASLR.

Comment 4 errata-xmlrpc 2026-05-19 13:02:38 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19019 https://access.redhat.com/errata/RHSA-2026:19019

Comment 5 errata-xmlrpc 2026-05-19 17:59:12 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19176 https://access.redhat.com/errata/RHSA-2026:19176


Note You need to log in before you can comment on or make changes to this bug.