CVE-2025-8291Improper Validation of Specified Index, Position, or Offset in Input in Software Foundation Cpython

Severity
4.3MEDIUMNVD
EPSS
0.1%
top 70.02%
CISA KEV
Not in KEV
Exploit
No known exploits
Timeline
PublishedOct 7
Latest updateNov 26

Description

The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations. Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Loc

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages1 packages

CVEListV5python_software_foundation/cpython3.10.03.10.19+5

🔴Vulnerability Details

5
OSV
python3.13 vulnerabilities2025-11-26
OSV
python3.12, python3.11, python3.10, python3.9, python3.8, python3.7, python3.6, python3.5, python3.4 vulnerabilities2025-11-24
OSV
CVE-2025-8291: The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate2025-10-07
GHSA
GHSA-49g5-f6qw-8mm7: The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate2025-10-07
CVEList
ZIP64 End of Central Directory (EOCD) Locator record offset not checked2025-10-07

📋Vendor Advisories

5
Ubuntu
Python vulnerabilities2025-11-26
Ubuntu
Python vulnerabilities2025-11-24
Microsoft
ZIP64 End of Central Directory (EOCD) Locator record offset not checked2025-10-14
Red Hat
cpython: python: Python zipfile End of Central Directory (EOCD) Locator record offset not checked2025-10-07
Debian
CVE-2025-8291: jython - The 'zipfile' module would not check the validity of the ZIP64 End of Central Di...2025
CVE-2025-8291 — MEDIUM severity | cvebase