CVE-2022-48560 — Use After Free in Python

CWE-416 — Use After Free12 documents7 sources
Severity
7.5HIGHNVD
OSV7.6
EPSS
0.2%
top 57.67%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
PythonDebian Python2.7Debian Python3.9+1 more
Timeline
PublishedAug 22
Latest updateMar 12

Description

A use-after-free exists in Python through 3.9 via heappushpop in heapq.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDpython/python3.7.0 — 3.7.7+3
▶debiandebian/python2.7< python2.7 2.7.18-8+deb11u1 (bullseye)
▶debiandebian/python3.9< python2.7 2.7.18-8+deb11u1 (bullseye)

Also affects: Debian Linux 10.0

Patches

Patch: bugs.python.org ↗Patch: bugs.python.org ↗

🔴Vulnerability Details

4
OSV
python2.7 vulnerabilities↗2025-01-06
▶
OSV
python3.5, python3.6, python3.7, python3.8, python3.9, python3.10, python3.11, python3.12 vulnerabilities↗2024-07-11
▶
OSV
CVE-2022-48560: A use-after-free exists in Python through 3↗2023-08-22
▶
GHSA
GHSA-pvw5-cvp6-cv92: A use-after-free exists in Python through 3↗2023-08-22
▶

📋Vendor Advisories

6
Ubuntu
Python vulnerabilities↗2025-01-06
▶
Ubuntu
Python vulnerabilities↗2024-07-11
▶
Ubuntu
Python vulnerability↗2023-10-17
▶
Ubuntu
Python vulnerability↗2023-09-21
▶
Red Hat
python: use after free in heappushpop() of heapq module↗2023-08-22
▶

📄Research Papers

1
arXiv
Cascade: Composing Software-Hardware Attack Gadgets for Adversarial Threat Amplification in Compound AI Systems↗2026-03-12
▶