Description
read_ints in plistlib.py in Python through 3.9.1 is vulnerable to a potential DoS attack via CPU and RAM exhaustion when processing malformed Apple Property List files in binary format.
Affected products
python: python; netapp: active iq unified manager
References6
- bugs.python.org/issue42103 ExploitIssue TrackingPatchVendor Advisory
- bugs.python.org/issue42103 ExploitIssue TrackingPatchVendor Advisory
- lists.debian.org/debian-lts-announce/2023/10/msg00017.html Mailing ListThird Party AdvisoryVDB Entry
- security.netapp.com/advisory/ntap-20230929-0009/ Third Party Advisory
- lists.debian.org/debian-lts-announce/2023/10/msg00017.html Mailing ListThird Party AdvisoryVDB Entry
- security.netapp.com/advisory/ntap-20230929-0009/ Third Party Advisory
Metrics
- CVSS 3.1
-
6.5
MEDIUM
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H - EPSS — exploit probability
- 2% percentile: 77 · as of 5 November 2026
- CWE
- CWE-400
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.