SecuriTricks - CVE-2025-8291

Description

The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations. Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.

Product(s) Impacted

Vendor	Product	Versions
Python	Python	*

Weaknesses

Common security weaknesses mapped to this vulnerability.

*CPE(s)

Affected systems and software identified for this CVE.

Type	Vendor	Product	Version	Update	Edition	Language	Software Edition	Target Software	Target Hardware	Other Information
a	python	python	/	/	/	/	/	/	/	/

References

https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267

https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6

https://github.com/python/cpython/issues/139700

https://github.com/python/cpython/pull/139702

https://mail.python.org/archives/list/security-announce@python.org/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/

CVSS Score

4.3 / 10

CVSS Data - 3.1

Attack Vector: NETWORK
Attack Complexity: LOW
Privileges Required: NONE
Scope: UNCHANGED
Confidentiality Impact: NONE
Integrity Impact: LOW
Availability Impact: NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

View Vector String

Timeline

Published: Oct. 7, 2025, 6:16 p.m.
Last Modified: Oct. 8, 2025, 7:38 p.m.

Status : Awaiting Analysis

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

cna@python.org

CVE-2025-8291