Security readout for executives and security teams
Plain-English summary
A privileged Python diagnostic process can be tricked into reading or changing its own memory when it repeatedly connects to a malicious Python target. Exploitation is difficult, commonly crashes the connecting process, and requires specific remote profiling or asyncio introspection features. Successful exploitation could expose sensitive data or alter the privileged process.
Executive priority
Treat as a targeted, moderate-priority issue. Prioritize teams using privileged Python diagnostics across trust boundaries. Broad emergency action is not supported by the supplied evidence, but affected workflows should be restricted and patched promptly because successful exploitation could compromise confidentiality and integrity.
Technical view
CPython remote profiling sampling and asyncio process introspection contain out-of-bounds read/write conditions, categorized as CWE-121 and CWE-125. The CVSS 4.0 score is 5.3, with local access, high complexity, high privileges, active user involvement, and no stated availability impact. ASLR makes repeated, persistent connections necessary and crashes likely.
Likely exposure
Exposure is limited to environments where privileged processes use the affected CPython remote debugging capabilities against untrusted or compromised Python processes. The supplied data identifies profiling sampling in Python 3.15+ and asyncio introspection in 3.14+, but its affected-version range is ambiguous; confirm exact releases with Python's advisory.
Exploitation context
No active exploitation is established: the CVE is not listed as KEV in the supplied bundle. Exploitation requires a malicious or infected target, a privileged connecting process, repeated connections, high complexity, and active operator involvement. ASLR makes crashes highly likely during attempts.
Researcher notes
The vulnerable party is the privileged process initiating remote debugging, while the target must be malicious or infected. Relevant features are profiling sampling and asyncio process introspection. The bundle cites upstream issue, pull request, and two commits, but does not name fixed release versions or demonstrate exploitation in the wild.
Mitigation direction
- Review the Python security advisory and apply the official CPython fixes or fixed release when identified.
- Restrict privileged remote profiling and asyncio introspection to trusted Python processes.
- Avoid repeatedly reconnecting diagnostic tools to suspicious or compromised targets.
- Monitor privileged diagnostic processes for crashes or unexpected memory-related failures.
Validation and detection
- Inventory CPython 3.14 and 3.15 deployments using remote profiling or asyncio introspection.
- Identify privileged workflows invoking profiling sampling, asyncio ps, or asyncio pstree against other processes.
- Confirm deployed source or binaries include the referenced CPython patches.
- Review logs for repeated diagnostic connections followed by connecting-process crashes.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-121: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCWE-125: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-5713 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 5.3 (4.0)
- Known Exploited
- No
- Published
Vector: CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N——PSFVulnerability scoring details
Base CVSS 4.0 score
5.3MediumVector: CVSS:4.0/AV:L/AC:H/AT:P/PR:H/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/python/cpython/pull/148187CVE reference, PSF · patch
- https://github.com/python/cpython/issues/148178CVE reference, PSF · issue-tracking
- https://mail.python.org/archives/list/security-announce@python.org/thread/OG4RHARYSNIE22GGOMVMCRH76L5HKPLM/CVE reference, PSF · vendor-advisory
- https://github.com/python/cpython/commit/289fd2c97a7e5aecb8b69f94f5e838ccfeee7e67CVE reference, PSF · patch
- https://github.com/python/cpython/commit/316f6265b7f9ca4ffed5346b747475ef1943f35dCVE reference, PSF · patch
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Stack-based Buffer Overflow
Stack-based Buffer Overflow represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.
Out-of-bounds Read
Out-of-bounds Read represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.