CVE-2016-5636

CRITICAL

CPython <2.7.12, <3.4.5, <3.5.2 - Buffer Overflow

Title source: llm

Description

Integer overflow in the get_data function in zipimport.c in CPython (aka Python) before 2.7.12, 3.x before 3.4.5, and 3.5.x before 3.5.2 allows remote attackers to have unspecified impact via a negative data size value, which triggers a heap-based buffer overflow.

Exploits (1)

nomisec WORKING POC 4 stars
by insuyun · poc
https://github.com/insuyun/CVE-2016-5636

References (15)

Scores

CVSS v3 9.8
EPSS 0.4512
EPSS Percentile 97.5%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE
CWE-190
Status draft

Affected Products (30)

python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
python/python
... and 15 more

Timeline

Published Sep 02, 2016
Tracked Since Feb 18, 2026