PT-2026-102606 · Pypy · Pypy
CVSS v4.0
6.3
متوسطة
| المتجه | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
PyPy versions prior to 3.11.16
PyPy versions prior to 3.12.14
Description
A use-after-free issue exists in the
pyexpat module's ExternalEntityParserCreate() function. This occurs when applications create external-entity sub-parsers without maintaining a reference to the parent parser. The child parser keeps a raw C back-pointer to the parent parser struct, but the tracing garbage collector may free the parent's C struct. Consequently, the bundled libexpat dereferences this freed pointer during token parsing, leading to memory corruption via a specially crafted XML document.Recommendations
Update to version 3.11.16 or later.
Update to version 3.12.14 or later.
استغلال
إصلاح
Use After Free
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾
تصنيف نقاط الضعف
المعرّفات ذات الصلة
المنتجات المتأثرة
Pypy