https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-14T19:38:03.871458+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/rustsec-2026-0013 RUSTSEC-2026-0013 — Type confusion when accessing data from sublasses of subclasses of native types with `abi3` feature targeting Python 3.… 2026-10-14T19:38:03.898219+00:00

Affected: crates.io: pyo3

PyO3 0.28.1 added support for `#[pyclass(extends=PyList)] struct NativeSub` (and other native types) when targeting Python 3.12 and up with the `abi3` feature.

It was discovered that subclasses of such classes would use the type of the subclass when attempting to access to data of `NativeSub` contained within Python objects, amounting to memory corruption.

PyO3 0.28.2 fixed the issue by using the type of (e.g.) `NativeSub` correctly.