CVE-2025-8291
Medium
Description
The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations. Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.
SeverityMedium
CVSS4.3
Exploit probability41. percentile0.5%
ProductCPython
PublishedOct 7, 2025
First seenOct 7, 2025
Weakness typeCWE-1285CWE-1285
How to fix
Update
- Python Software Foundation CPython3.9.24, 3.10.19, 3.11.14, 3.12.12, 3.13.10, 3.14.1 or later
Patches
- github.com/python/cpython/pull/139702
- github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267
- github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6
- github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46
- github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196
- github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4
- github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388
- github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Python Software Foundation CPython | v < 3.9.24, 3.10.0 ≤ v < 3.10.19, 3.11.0 ≤ v < 3.11.14, 3.12.0 ≤ v < 3.12.12, 3.13.0 ≤ v < 3.13.10, 3.14.0 ≤ v < 3.14.1 | 3.9.24, 3.10.19, 3.11.14, 3.12.12, 3.13.10, 3.14.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.