GitHub Advisoryadvisory · crates.io

GHSA-47qc-857f-7w7f PyO3 has type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature

HIGH Published 2026-02-19 Modified 2026-02-19 Official page ↗
Ecosystem
crates.io
Packages
pyo3
Severity
High
CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
Weaknesses
CWE-843
Reviewed
2026-02-19

Affected packages

• crates.io pyo3: >= 0.28.0, < 0.28.2 → fixed in 0.28.2

Description

PyO3 0.28.1 added support for `#[pyclass(extends=PyList)] struct NativeSub` (and other native types) when targeting Python 3.12 and up with the `abi3` feature. It was discovered that subclasses of such classes would use the type of the subclass when attempting to access to data of `NativeSub` contained within Python objects, amounting to memory corruption. PyO3 0.28.2 fixed the issue by using the type of (e.g.) `NativeSub` correctly.

Related

Weakness · CWE (1)

  • CWE-843 Access of Resource Using Incompatible Type weakness

References