ZeroDay Findings
Sign inSign up

Findings

CVE-2021-3177

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept…

Published Jan 19, 2021 · updated Oct 14, 2026 · python python

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 19, 2021 · NIST NVD

    Detected

    Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

  2. Oct 14, 2026 · NIST NVD

    Updated

    Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Affected

  • cpe debian/debian linux9.0
  • cpe fedoraproject/fedora32
  • cpe fedoraproject/fedora33
  • cpe netapp/active iq unified managerversion unspecified
  • cpe oracle/communications cloud native core network function cloud native environment22.2.0
  • cpe python/pythonversion unspecified

Sources

  • CVE.orgVulnerability recordCVE-2021-3177

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2021-3177

    30-day exploitation probability 24.2%

    first.org
  • NIST NVDVulnerability recordCVE-2021-3177

    Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occu

    nvd.nist.gov

References