CVE-2025-13462: tarfile: Skip DIRTYPE normalization during GNU LONGNAME/LONGLINK handling
Analyzed
AliasesUBUNTU-CVE-2025-13462DEBIAN-CVE-2025-13462CGA-25f6-5cxg-gxxxCGA-6fxm-pqmf-fc74CGA-8j9f-6737-4cvmCGA-8wrr-g4v2-c23qCGA-gfh9-cpfg-7xm6CGA-gw48-8hh3-chwgCGA-hm76-h233-rhm4CGA-wppv-wm75-qv92CGA-wpw5-rq3h-873cCGA-xfgf-hggg-j9mhCGA-6gc8-cg7g-qhx7CGA-8h76-8f97-627j
Published 12-03-2026Last modified 13-08-2026
Vulnerability summary
CVE-2025-13462 is a low (CVSS 3.3) Improper Input Validation vulnerability in python software foundation cpython. EPSS estimates a 0.17% chance of exploitation in the next 30 days, higher than 6.4% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 2, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
3.3/10
010
Low · v3.1 (NVD)EPSS score
0.17%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 27 · Related 24OPENSUSE-SU-2026:10469-1OPENSUSE-SU-2026:10477-1OPENSUSE-SU-2026:10478-1OPENSUSE-SU-2026:10479-1OPENSUSE-SU-2026:10480-1OPENSUSE-SU-2026:10481-1OPENSUSE-SU-2026:20517-1RHSA-2026:10118RHSA-2026:11324RHSA-2026:7443RHSA-2026:7661SUSE-SU-2026:1206-1SUSE-SU-2026:1292-1SUSE-SU-2026:1296-1SUSE-SU-2026:1345-1SUSE-SU-2026:1349-1SUSE-SU-2026:1354-1SUSE-SU-2026:1376-1SUSE-SU-2026:1385-1SUSE-SU-2026:1417-1SUSE-SU-2026:1530-1SUSE-SU-2026:21104-1SUSE-SU-2026:21178-1SUSE-SU-2026:21254-1SUSE-SU-2026:23743-1SUSE-SU-2026:4534-1USN-8509-1CGA-56X7-W5G7-CP2R
Timeline
- 12-03-2026PublishedVulnerability first disclosed.
- 13-08-2026Last modifiedVulnerability information updated.
Description
The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
CVSS metrics
8 scores · 6 sources · 2 versionsLow 2.0Preferred score · CVE.org (CNA)
CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NSourcesAll 5 agree
- OSV · UbuntuEcosystem advisory · calculated2.0LowCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- OSV · WolfiEcosystem advisory · calculated2.0LowCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated2.0LowCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
- NVDNIST2.0LowCVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Low 3.3Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:NSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated3.3LowCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.17%
Chance of exploitation in the next 30 days
Percentile
6%
Versus all other CVEs
30-day change
Increase +0.01 pp
From 0.16% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-74Improper Neutralization of Special Elements in Output Used by a Downstream ComponentThe product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
- CWE-434Unrestricted Upload of File with Dangerous TypeThe product allows the upload or transfer of dangerous file types that are automatically processed within its environment.
Affected systems
Version check
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Ubuntu12 products
- python2.7All versions (No fix recorded)
- python3.10< 3.10.12-1~22.04.16
- python3.11All versions (No fix recorded)
- python3.12< 3.12.3-1ubuntu0.15
- python3.13All versions (No fix recorded)
Chainguard6 products
- python-3.10< 3.10.21-r6
- python-3.11< 3.11.15-r9
- python-3.12< 3.12.14-r8
- python-3.13< 3.13.13-r0
- python-3.14< 3.14.4-r0
Wolfi5 products
- python-3.10< 3.10.21-r6
- python-3.11< 3.11.15-r9
- python-3.12< 3.12.14-r8
- python-3.13< 3.13.13-r0
- python-3.14< 3.14.4-r0
Debian3 products
- python3.11< 3.11.2-6+deb12u8
- python3.13< 3.13.14-1 | < 3.13.5-2+deb13u1
- python3.14< 3.14.3-4
Python1 product
- python< 3.13.13 | ≥ 3.14.0, < 3.14.4 | 3.15.0:alpha1 | 3.15.0:alpha2 | 3.15.0:alpha3 | 3.15.0:alpha4 | 3.15.0:alpha5 | 3.15.0:alpha6 | 3.15.0:alpha7
Python software foundation1 product
- cpython< 3.10.21 | ≥ 3.11.0, < 3.11.16 | ≥ 3.12.0, < 3.12.14 | ≥ 3.13.0, < 3.13.13 | ≥ 3.14.0, < 3.14.4 | ≥ 3.15.0a1, < 3.15.0a8
6 vendors · 28 products
References
16 links- mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/Vendor AdvisoryAdvisoryMailing List
Show all 16 references
- github.com/python/cpythonPACKAGE