ZeroDay Findings
Sign inSign up

Findings

CVE-2021-3177

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept…

Published Jan 19, 2021 · updated Oct 14, 2026 · python python

Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Timeline

Detection, updates, and resolution for this record.

  1. Jan 19, 2021 · NIST NVD

    Detected

    Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

  2. Oct 14, 2026 · NIST NVD

    Updated

    Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf is used unsafely.

Affected

  • cpe debian/debian linux9.0
  • cpe fedoraproject/fedora32
  • cpe fedoraproject/fedora33
  • cpe netapp/active iq unified managerversion unspecified
  • cpe oracle/communications cloud native core network function cloud native environment22.2.0
  • cpe python/pythonversion unspecified

Sources

  • CVE.orgCVE-2021-3177

    Official CVE identifier

    cve.org
  • FIRST EPSSCVE-2021-3177

    30-day exploitation probability 24.2%

    first.org
  • NIST NVDCVE-2021-3177

    Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occu

    nvd.nist.gov

References