AIKIDO-2026-418522

TL;DR

The C extension object proxy in wrapt swaps internal fields such as the wrapped object without serializing the update. On free-threaded Python builds, where the package opts out of the global interpreter lock, two threads that concurrently mutate the same shared proxy can both release the previous value, and borrowed references in the proxy, operator, delegation, and wrapper-call paths can be used after another thread frees them. This double release and use-after-free corrupts interpreter memory and typically crashes the process. The fix serializes the field swaps with per-object critical sections and acquires strong references across the affected paths.