CRITICAL 9.8 Microsoft

CVE-2021-3177

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Microsoft Security Update 2021-Jan: Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Affected Products

References

Published: 2021-01-12 · Source: Microsoft · Feed updated: 2026-09-07
This critical severity vulnerability with a CVSS score of 9.8 was published on 2021-01-12 via Microsoft. EPSS score: 23.3% (top 2% of all CVEs by exploitation probability). Affected: python3-3.7.9-4.cm1.x86_64.rpm on CBL Mariner 1.0 x64, python3-libs-3.7.9-4.cm1.x86_64.rpm on CBL Mariner 1.0 x64, python3-xml-3.7.9-4.cm1.x86_64.rpm on CBL Mariner 1.0 x64 and 5 more.

Risk Timeline

CVE Disclosed2021-01-12 · 2063 days ago

Remediation Resources

Official Advisory
msrc.microsoft.com/update-guide/vulnerability/CVE-2021-3177
NVD / MITRE
nvd.nist.gov/vuln/detail/CVE-2021-3177
vulnfeed aggregates 10539 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.