AIKIDO-2026-775417

TL;DR

numpy.rec.fromstring and numpy.rec.fromfile build a recarray directly over a caller-supplied byte buffer or file according to a caller-supplied dtype, without checking whether that dtype contains object references. When the dtype includes reference fields, the raw buffer bytes land in memory that NumPy later treats as PyObject* pointers, so arbitrary bytes from an untrusted string or file get dereferenced and reference-counted as if they were real Python objects. Reading or garbage-collecting the resulting array can crash the process or corrupt memory. The fix rejects dtypes whose hasobject flag is set before constructing the array.