AIKIDO-2025-10198
pyo3 is vulnerable to Buffer Overflow
30
Low Risk
This Affects:
pyo3TL;DR
Affected versions of this package are vulnerable to an out-of-bounds read in PyString::from_object, which directly forwards &str arguments to the Python C API without ensuring a null-terminated string. This could cause the Python interpreter to read beyond the allocated data, potentially leaking sensitive information in an exception message. In PyO3 0.24.1, this issue is mitigated by allocating a CString to ensure proper null termination, and PyO3 0.25 is expected to introduce an alternative API that accepts &CStr arguments.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
pyo3 is vulnerable to Buffer Overflow in versions 0.21.0 - 0.24.0.
How to fix this
Upgrade the pyo3 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant