CVE-2025-8291
Medium · 4.3CVSS
4.3
EPSS
0.5%
Published
Oct 7, 2025
CISA due date
—
Cloudanix analysis
Monitor only
SSVC: Track
Python's ZIP file handling could let specially made archives be read differently than expected, which might cause programs to mishandle files in ways that affect data accuracy.
- Exploitation
- Requires User Interaction
- Attacker needs
- User Interaction
- Complexity
- Low
- Impact
- Data Tampering
- Component
- Library
- Class
- Improper Input Validation
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
The zipfile module fails to validate the offset value in the ZIP64 End of Central Directory Locator record and instead assumes the ZIP64 EOCD record is the immediately preceding record in the archive, enabling crafted ZIP files to be parsed inconsistently with other implementations.
Why it matters to the business
Applications relying on Python zipfile for archive processing may handle specially crafted ZIP files differently than standard tools, creating integrity risks during extraction or validation in automated pipelines and third-party integrations.
How an attack unfolds
An attacker constructs a ZIP archive containing a ZIP64 EOCD Locator with an offset that does not point to the actual ZIP64 EOCD record; when processed by the vulnerable zipfile module the incorrect assumption about record placement leads to divergent archive interpretation compared with compliant ZIP parsers.
How to fix it
Upgrade python/cpython to the commit 162997bb70e067668c039700141770687bc8f267 or later; the fix adds validation that the offset in the ZIP64 EOCD Locator matches the expected location while preserving existing behavior.
How to confirm the fix worked
Confirm the commit 162997bb70e067668c039700141770687bc8f267 is present in the Python build; test with ZIP archives containing invalid ZIP64 EOCD Locator offsets to verify the new offset-matching check is enforced.
Typical attack path
- Craft a ZIP archive with a manipulated ZIP64 EOCD Locator offset
- Deliver the archive through network channels or file uploads
- Trigger processing via Python code that uses the zipfile module
- Exploit inconsistent parsing to bypass integrity checks or alter extraction behavior
How to detect it
Review application logs for zipfile parsing anomalies or offset-related errors when processing ZIP archives; no public exploitation artifacts are known at this time.
What your security team should do
- Apply the fixed commit 162997bb70e067668c039700141770687bc8f267 across all Python environments
- Audit code paths that use zipfile for archive handling and add secondary validation where feasible
- Monitor EPSS trend and re-evaluate if exploit maturity increases
The record
The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations. Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| AlmaLinux:10 | python-unversioned-command | 0 | 3.12.12-1.el10_1 |
| AlmaLinux:10 | python3 | 0 | 3.12.12-1.el10_1 |
| AlmaLinux:10 | python3-debug | 0 | 3.12.12-1.el10_1 |
| AlmaLinux:10 | python3-devel | 0 | 3.12.12-1.el10_1 |
| AlmaLinux:10 | python3-idle | 0 | 3.12.12-1.el10_1 |
| AlmaLinux:10 | python3-libs | 0 | 3.12.12-1.el10_1 |
| AlmaLinux:10 | python3-test | 0 | 3.12.12-1.el10_1 |
| AlmaLinux:10 | python3-tkinter | 0 | 3.12.12-1.el10_1 |
| AlmaLinux:8 | python3.12 | 0 | 3.12.12-1.el8_10 |
| AlmaLinux:8 | python3.12-debug | 0 | 3.12.12-1.el8_10 |
| AlmaLinux:8 | python3.12-devel | 0 | 3.12.12-1.el8_10 |
| AlmaLinux:8 | python3.12-idle | 0 | 3.12.12-1.el8_10 |
| AlmaLinux:8 | python3.12-libs | 0 | 3.12.12-1.el8_10 |
| AlmaLinux:8 | python3.12-rpm-macros | 0 | 3.12.12-1.el8_10 |
| AlmaLinux:8 | python3.12-test | 0 | 3.12.12-1.el8_10 |
| AlmaLinux:8 | python3.12-tkinter | 0 | 3.12.12-1.el8_10 |
| AlmaLinux:8 | python39 | 0 | 3.9.25-2.module_el8.10.0+4083+53cad1fb |
| AlmaLinux:8 | python39-Cython | 0 | 0.29.21-5.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-Cython | 0 | 0.29.21-5.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-PyMySQL | 0 | 0.10.1-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-attrs | 0 | 20.3.0-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-cffi | 0 | 1.14.3-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-cffi | 0 | 1.14.3-2.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-chardet | 0 | 3.0.4-19.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-cryptography | 0 | 3.3.1-3.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-debug | 0 | 3.9.25-2.module_el8.10.0+4083+53cad1fb |
| AlmaLinux:8 | python39-devel | 0 | 3.9.25-2.module_el8.10.0+4083+53cad1fb |
| AlmaLinux:8 | python39-idle | 0 | 3.9.25-2.module_el8.10.0+4083+53cad1fb |
| AlmaLinux:8 | python39-idna | 0 | 2.10-4.module_el8.10.0+3849+a48d89aa |
| AlmaLinux:8 | python39-iniconfig | 0 | 1.1.1-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-libs | 0 | 3.9.25-2.module_el8.10.0+4083+53cad1fb |
| AlmaLinux:8 | python39-lxml | 0 | 4.6.5-1.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-lxml | 0 | 4.6.5-1.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-mod_wsgi | 0 | 4.7.1-7.module_el8.10.0+3989+a618fe15.1 |
| AlmaLinux:8 | python39-more-itertools | 0 | 8.5.0-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-numpy | 0 | 1.19.4-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-numpy | 0 | 1.19.4-3.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-numpy-doc | 0 | 1.19.4-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-numpy-f2py | 0 | 1.19.4-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-numpy-f2py | 0 | 1.19.4-3.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-packaging | 0 | 20.4-4.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pip | 0 | 20.2.4-9.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-pip-wheel | 0 | 20.2.4-9.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-pluggy | 0 | 0.13.1-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-ply | 0 | 3.11-10.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-psutil | 0 | 5.8.0-4.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-psutil | 0 | 5.8.0-4.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-psycopg2 | 0 | 2.8.6-3.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-psycopg2-doc | 0 | 2.8.6-3.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-psycopg2-tests | 0 | 2.8.6-3.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-py | 0 | 1.10.0-1.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pybind11 | 0 | 2.7.1-1.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pybind11 | 0 | 2.7.1-1.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-pybind11-devel | 0 | 2.7.1-1.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pybind11-devel | 0 | 2.7.1-1.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-pycparser | 0 | 2.20-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pyparsing | 0 | 2.4.7-5.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pysocks | 0 | 1.7.1-4.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pytest | 0 | 6.0.2-2.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pyyaml | 0 | 5.4.1-1.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-pyyaml | 0 | 5.4.1-1.module_el8.6.0+3248+c431e88c |
| AlmaLinux:8 | python39-requests | 0 | 2.25.0-3.module_el8.9.0+3634+fb2a896c |
| AlmaLinux:8 | python39-rpm-macros | 0 | 3.9.25-2.module_el8.10.0+4083+53cad1fb |
| AlmaLinux:8 | python39-scipy | 0 | 1.5.4-5.module_el8.9.0+3634+fb2a896c |
| AlmaLinux:8 | python39-setuptools | 0 | 50.3.2-7.module_el8.10.0+4040+9207bbc0 |
| AlmaLinux:8 | python39-setuptools-wheel | 0 | 50.3.2-7.module_el8.10.0+4040+9207bbc0 |
| AlmaLinux:8 | python39-six | 0 | 1.15.0-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-test | 0 | 3.9.25-2.module_el8.10.0+4083+53cad1fb |
| AlmaLinux:8 | python39-tkinter | 0 | 3.9.25-2.module_el8.10.0+4083+53cad1fb |
| AlmaLinux:8 | python39-toml | 0 | 0.10.1-5.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-urllib3 | 0 | 1.25.10-5.module_el8.10.0+3765+2f9a457d |
| AlmaLinux:8 | python39-wcwidth | 0 | 0.2.5-3.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-wheel | 0 | 1:0.35.1-4.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:8 | python39-wheel-wheel | 0 | 1:0.35.1-4.module_el8.6.0+2780+a40f65e1 |
| AlmaLinux:9 | python-unversioned-command | 0 | 3.9.25-2.el9_7 |
| AlmaLinux:9 | python3 | 0 | 3.9.25-2.el9_7 |
| AlmaLinux:9 | python3-debug | 0 | 3.9.25-2.el9_7 |
| AlmaLinux:9 | python3-devel | 0 | 3.9.25-2.el9_7 |
| AlmaLinux:9 | python3-idle | 0 | 3.9.25-2.el9_7 |
| AlmaLinux:9 | python3-libs | 0 | 3.9.25-2.el9_7 |
| AlmaLinux:9 | python3-test | 0 | 3.9.25-2.el9_7 |
| AlmaLinux:9 | python3-tkinter | 0 | 3.9.25-2.el9_7 |
| AlmaLinux:9 | python3.12 | 0 | 3.12.12-1.el9_7 |
| AlmaLinux:9 | python3.12-debug | 0 | 3.12.12-1.el9_7 |
| AlmaLinux:9 | python3.12-devel | 0 | 3.12.12-1.el9_7 |
| AlmaLinux:9 | python3.12-idle | 0 | 3.12.12-1.el9_7 |
| AlmaLinux:9 | python3.12-libs | 0 | 3.12.12-1.el9_7 |
| AlmaLinux:9 | python3.12-test | 0 | 3.12.12-1.el9_7 |
| AlmaLinux:9 | python3.12-tkinter | 0 | 3.12.12-1.el9_7 |
| Bitnami | libpython | 0 | No fix |
| Bitnami | libpython | 0 | 3.9.24 |
| Bitnami | python | 0 | No fix |
| Bitnami | python | 0 | 3.9.24 |
| Bitnami | python-min | 0 | No fix |
| Bitnami | python-min | 0 | 3.9.24 |
| Chainguard | python-3.10 | 0 | 3.10.19-r0 |
| Chainguard | python-3.10-base | 0 | 3.10.19-r0 |
| Chainguard | python-3.10-base-dev | 0 | 3.10.19-r0 |
| Chainguard | python-3.10-dev | 0 | 3.10.19-r0 |
| Chainguard | python-3.10-doc | 0 | 3.10.19-r0 |
| Chainguard | python-3.11 | 0 | 3.11.14-r0 |
| Chainguard | python-3.11-base | 0 | 3.11.14-r0 |
| Chainguard | python-3.11-base-dev | 0 | 3.11.14-r0 |
| Chainguard | python-3.11-dev | 0 | 3.11.14-r0 |
| Chainguard | python-3.11-doc | 0 | 3.11.14-r0 |
| Chainguard | python-3.12 | 0 | 3.12.12-r0 |
| Chainguard | python-3.12-base | 0 | 3.12.12-r0 |
| Chainguard | python-3.12-base-dev | 0 | 3.12.12-r0 |
| Chainguard | python-3.12-dev | 0 | 3.12.12-r0 |
| Chainguard | python-3.12-doc | 0 | 3.12.12-r0 |
| Chainguard | python-3.12-privileged-netbindservice | 0 | 3.12.12-r0 |
| Chainguard | python-3.12-tk | 0 | 3.12.12-r0 |
| Chainguard | python-3.13 | 0 | 3.13.8-r1 |
| Chainguard | python-3.13-base | 0 | 3.13.8-r1 |
| Chainguard | python-3.13-base-dev | 0 | 3.13.8-r1 |
| Chainguard | python-3.13-dev | 0 | 3.13.8-r1 |
| Chainguard | python-3.13-doc | 0 | 3.13.8-r1 |
| Chainguard | python-3.13-privileged-netbindservice | 0 | 3.13.8-r1 |
| Chainguard | python-3.13-tk | 0 | 3.13.8-r1 |
| Chainguard | python-3.14 | 0 | 3.14.0-r2 |
| Chainguard | python-3.14-base | 0 | 3.14.0-r2 |
| Chainguard | python-3.14-base-dev | 0 | 3.14.0-r2 |
| Chainguard | python-3.14-dev | 0 | 3.14.0-r2 |
| Chainguard | python-3.14-doc | 0 | 3.14.0-r2 |
| Chainguard | python-3.14-privileged-netbindservice | 0 | 3.14.0-r2 |
| Chainguard | python-3.14-tk | 0 | 3.14.0-r2 |
| Chainguard | python-3.14t | 0 | 3.14.0-r2 |
| Chainguard | python-3.9 | 0 | 3.9.24-r0 |
| Chainguard | python-3.9-base | 0 | 3.9.24-r0 |
| Chainguard | python-3.9-base-dev | 0 | 3.9.24-r0 |
| Chainguard | python-3.9-default | 0 | 3.9.24-r0 |
| Chainguard | python-3.9-dev | 0 | 3.9.24-r0 |
| Chainguard | python-3.9-doc | 0 | 3.9.24-r0 |
| SUSE:Linux Enterprise Micro 5.2 | python3 | 0 | 3.6.15-150300.10.100.1 |
| SUSE:Linux Enterprise Micro 5.2 | python3-core | 0 | 3.6.15-150300.10.100.1 |
| SUSE:Linux Enterprise Micro 5.3 | python3 | 0 | 3.6.15-150300.10.100.1 |
| SUSE:Linux Enterprise Micro 5.3 | python3-core | 0 | 3.6.15-150300.10.100.1 |
| SUSE:Linux Enterprise Micro 5.4 | python3 | 0 | 3.6.15-150300.10.100.1 |
| SUSE:Linux Enterprise Micro 5.4 | python3-core | 0 | 3.6.15-150300.10.100.1 |
| SUSE:Linux Enterprise Micro 5.5 | python3 | 0 | 3.6.15-150300.10.100.1 |
| SUSE:Linux Enterprise Micro 5.5 | python3-core | 0 | 3.6.15-150300.10.100.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | python3 | 0 | 3.6.15-150300.10.100.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | python3-core | 0 | 3.6.15-150300.10.100.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP6 | python311-core | 0 | 3.11.14-150600.3.38.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | python3 | 0 | 3.6.15-150300.10.100.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | python3-core | 0 | 3.6.15-150300.10.100.1 |
| SUSE:Linux Enterprise Module for Basesystem 15 SP7 | python311-core | 0 | 3.11.14-150600.3.38.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP6 | python3-core | 0 | 3.6.15-150300.10.100.1 |
| SUSE:Linux Enterprise Module for Development Tools 15 SP7 | python3-core | 0 | 3.6.15-150300.10.100.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | python | 0 | 2.7.18-150000.86.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | python | 0 | 2.7.18-150000.89.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | python-base | 0 | 2.7.18-150000.86.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP6 | python-base | 0 | 2.7.18-150000.89.2 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | python | 0 | 2.7.18-150000.86.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | python | 0 | 2.7.18-150000.89.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | python-base | 0 | 2.7.18-150000.86.1 |
| SUSE:Linux Enterprise Module for Package Hub 15 SP7 | python-base | 0 | 2.7.18-150000.89.2 |
| SUSE:Linux Enterprise Module for Python 3 15 SP6 | python311 | 0 | 3.11.14-150600.3.38.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP6 | python311-core | 0 | 3.11.14-150600.3.38.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP6 | python312 | 0 | 3.12.12-150600.3.37.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP6 | python312-core | 0 | 3.12.12-150600.3.37.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python311 | 0 | 3.11.14-150600.3.38.1 |
| SUSE:Linux Enterprise Module for Python 3 15 SP7 | python311-core | 0 | 3.11.14-150600.3.38.1 |
| Wolfi | python-3.10 | 0 | 3.10.19-r0 |
| Wolfi | python-3.10-base | 0 | 3.10.19-r0 |
| Wolfi | python-3.10-base-dev | 0 | 3.10.19-r0 |
| Wolfi | python-3.10-dev | 0 | 3.10.19-r0 |
| Wolfi | python-3.10-doc | 0 | 3.10.19-r0 |
| Wolfi | python-3.11 | 0 | 3.11.14-r0 |
| Wolfi | python-3.11-base | 0 | 3.11.14-r0 |
| Wolfi | python-3.11-base-dev | 0 | 3.11.14-r0 |
| Wolfi | python-3.11-dev | 0 | 3.11.14-r0 |
| Wolfi | python-3.11-doc | 0 | 3.11.14-r0 |
| Wolfi | python-3.12 | 0 | 3.12.12-r0 |
| Wolfi | python-3.12-base | 0 | 3.12.12-r0 |
| Wolfi | python-3.12-base-dev | 0 | 3.12.12-r0 |
| Wolfi | python-3.12-dev | 0 | 3.12.12-r0 |
| Wolfi | python-3.12-doc | 0 | 3.12.12-r0 |
| Wolfi | python-3.12-privileged-netbindservice | 0 | 3.12.12-r0 |
| Wolfi | python-3.12-tk | 0 | 3.12.12-r0 |
| Wolfi | python-3.13 | 0 | 3.13.8-r1 |
| Wolfi | python-3.13-base | 0 | 3.13.8-r1 |
| Wolfi | python-3.13-base-dev | 0 | 3.13.8-r1 |
| Wolfi | python-3.13-dev | 0 | 3.13.8-r1 |
| Wolfi | python-3.13-doc | 0 | 3.13.8-r1 |
| Wolfi | python-3.13-privileged-netbindservice | 0 | 3.13.8-r1 |
| Wolfi | python-3.13-tk | 0 | 3.13.8-r1 |
| Wolfi | python-3.14 | 0 | 3.14.0-r2 |
| Wolfi | python-3.14-base | 0 | 3.14.0-r2 |
| Wolfi | python-3.14-base-dev | 0 | 3.14.0-r2 |
| Wolfi | python-3.14-dev | 0 | 3.14.0-r2 |
| Wolfi | python-3.14-doc | 0 | 3.14.0-r2 |
| Wolfi | python-3.14-privileged-netbindservice | 0 | 3.14.0-r2 |
| Wolfi | python-3.14-tk | 0 | 3.14.0-r2 |
| Wolfi | python-3.14t | 0 | 3.14.0-r2 |
| openSUSE:Leap 15.6 | python | 0 | 2.7.18-150000.86.1 |
| openSUSE:Leap 15.6 | python | 0 | 2.7.18-150000.89.1 |
| openSUSE:Leap 15.6 | python-base | 0 | 2.7.18-150000.86.1 |
| openSUSE:Leap 15.6 | python-base | 0 | 2.7.18-150000.89.2 |
| openSUSE:Leap 15.6 | python-doc | 0 | 2.7.18-150000.86.1 |
Related vulnerabilities
- CVE-2025-8194 There is a defect in the CPython “tarfile” module affecting the “TarFile” extraction and… Also affects python-unversioned-command
- CVE-2024-12718 Allows modifying some file metadata (e.g. Also affects python-unversioned-command
- CVE-2025-4517 Allows arbitrary filesystem writes outside the extraction directory during extraction… Also affects python-unversioned-command
- CVE-2025-4138 Allows the extraction filter to be ignored, allowing symlink targets to point outside the… Also affects python-unversioned-command
- CVE-2025-4330 Allows the extraction filter to be ignored, allowing symlink targets to point outside the… Also affects python-unversioned-command
- CVE-2025-4435 When using a TarFile.errorlevel = 0 and extracting with a filter the documented behavior… Also affects python-unversioned-command
- CVE-2025-12084 When building nested elements using xml.dom.minidom methods such as appendChild() that… Also affects python3.12
- CVE-2024-12254 Starting in Python 3.12.0, the asyncio._SelectorSocketTransport.writelines() method would… Also affects python3.12