Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

numpy/numpy

              main @ 73d1419
            

Fixes

CVEs

CRITICAL

Peak severity

40.0%

Coverage

Highlights

Memory Corruption: 4 prior fixes. Scrutinize any change in this area.

numpy/_core: most-fixed (1 issue). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Memory Corruption: Custom dtypes like StringDType are highly susceptible to heap buffer overflows and allocator safety bugs when performing search, comparison, or copy operations across mismatched descriptors or incompatible views. Improper handling of custom comparisons or incorrect assumptions about descriptor equality directly lead to corruption.

Memory Corruption: Mismanaged reference counting (Py_DECREF/Py_XDECREF) and failure to clean up resources during error propagation pathways in functions like array_setstate or array creation APIs create severe memory leaks and corruption vectors, particularly during complex operations like unpickling.

Memory Corruption: Missing verification of structural properties, such as alignment, on user-supplied source arrays prior to invoking core transfer functions (like PyArray_GetDTypeTransferFunction) leads to invalid memory operations and silent memory corruption.