An incomplete string comparison in the numpy.core component in NumPy before 1.22.0 allows attackers to trigger slightly incorrect copying by constructing specific string objects. NOTE: the vendor states that this reported code behavior is "completely harmless."
Fix
Patch, vendor advisory and mitigation references on NVD 4
- https://github.com/numpy/numpy/issues/18993 Exploit, Issue Tracking, Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- https://github.com/numpy/numpy/issues/18993 Exploit, Issue Tracking, Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 5.3 · numpy, oracleNVD modified 2026-10-08 21:17
Affected (CPE criteria) 2
cpe:2.3:a:numpy:numpy:*:*:*:*:*:*:*:*cpe:2.3:a:oracle:communications_cloud_native_core_policy:22.1.3:*:*:*:*:*:*:*
References 4
- https://github.com/numpy/numpy/issues/18993 Exploit, Issue Tracking, Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory
- https://github.com/numpy/numpy/issues/18993 Exploit, Issue Tracking, Patch, Third Party Advisory
- https://www.oracle.com/security-alerts/cpujul2022.html Patch, Third Party Advisory