CVE-2026-5713 Python Software Foundation CVE debrief

Who should care

Organizations running Python 3.14+ or 3.15+ with remote debugging enabled, especially in multi-tenant environments or where privileged processes interact with potentially untrusted Python instances; security teams monitoring for local privilege escalation vectors in Python deployments

Technical summary

The profiling.sampling module (Python 3.15+) and asyncio introspection capabilities (3.14+, including 'python -m asyncio ps' and 'python -m asyncio pstree') expose a vulnerability where a malicious or 'infected' Python process can read and write memory addresses in a privileged process that connects via remote debugging. The attack requires persistent, repeated connections due to ASLR causing high-likelihood crashes, making exploitation difficult but possible. The vulnerability is classified as MEDIUM severity (CVSS 5.3) with high confidentiality and integrity impacts under CVSS 4.0, reflecting the need for local access, high attack complexity, privileged prerequisites, and user interaction.

Defensive priority

medium

Recommended defensive actions

• Upgrade Python to a patched version once available; monitor python/cpython commits ref-4 and ref-5 for backports
• Disable or restrict access to remote debugging features (asyncio introspection in 3.14+, profiling.sampling in 3.15+) in production environments where privileged processes may connect to untrusted Python instances
• Apply network segmentation and access controls to prevent privileged processes from connecting to untrusted or potentially compromised Python processes
• Monitor for repeated connection attempts and crashes in processes using Python remote debugging, as exploitation requires persistent reconnection and ASLR-induced crashes
• Review and restrict use of 'python -m asyncio ps', 'python -m asyncio pstree', and profiling.sampling module in security-sensitive deployments
• Subscribe to Python security announcements via the [email protected] mailing list for updates

Evidence notes

Vendor identification is low-confidence based on reference domain candidate 'Python'; vendor field marked needsReview. CNA source is [email protected]. CVSS 4.0 vector provided in source metadata. No KEV listing. VulnStatus: Awaiting Analysis.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.