UAF: xml.etree.ElementTree.Element.__deepcopy__ when concurrent mutations happen

[picnixz]

Crash report

What happened?

Reproducer:

import xml.etree.ElementTree as ET
from copy import deepcopy

class Evil(ET.Element):
    def __deepcopy__(self, memo):
        root.clear()
        return self

root = ET.Element('a')
root.append(Evil('x'))
deepcopy(root)

CPython versions tested on:

CPython main branch

Operating systems tested on:

No response

Output from running 'python -VV' on the command line:

Python 3.14.0a7+ (heads/main:7f02ded29fb, Apr 26 2025, 14:29:01) [GCC 7.5.0]

Linked PRs

• gh-133009: fix UAF in xml.etree.ElementTree.Element.__deepcopy__ #133010