CVE-2026-39892
CriticalCVSS 9.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
The cryptography library for Python versions 45.0.0 through 46.0.6 contains a buffer overflow vulnerability. The issue occurs when a non-contiguous buffer is passed to APIs that accept Python buffers (e.g., Hash.update()). The flaw is fixed in version 46.0.7.
Risk Assessment
An attacker could exploit this vulnerability to cause a buffer overflow, potentially leading to unexpected application behavior, data leakage, or remote code execution.
Recommendation
Immediately update the cryptography library to version 46.0.7 or later.
Original NVD description (English source)
cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer overflows. This vulnerability is fixed in 46.0.7.