CVE-2025-8291: python software foundation cpython
CVSS: 4.3v3.1MediumDeferred
AliasesSUSE-SU-2025:4313-1RHSA-2025:23323RHSA-2025:23940RHSA-2026:0353RHSA-2026:0354RHSA-2026:0355UBUNTU-CVE-2025-8291DEBIAN-CVE-2025-8291CGA-2ggr-fjww-gcprCGA-2pcc-9jgm-82c5CGA-5gm9-c74c-5mmhCGA-5v4f-2w9g-f95cCGA-cm3p-7mh3-mpvjCGA-gw64-xx5q-wv8fCGA-h377-pc9x-35x7CGA-j2x5-gf5c-3qfhCGA-rwcw-mcq3-58x9CGA-vcgj-g6cw-r5jmCGA-7xv2-h2gr-5wc8CGA-xvj6-5fpj-2mfq
Published 07-10-2025Last modified 31-07-2026
Vulnerability summary
CVE-2025-8291 is a medium (CVSS 4.3) vulnerability in python software foundation cpython. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 38.9% of scored vulnerabilities. 1 public exploit is recorded.
CVSS score
4.3/10
010
Medium · v3.1 (CVE.org)EPSS score
0.47%
0%100%
Low · +0.09 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 35 · Related 28DLA-4354-1DLA-4445-1OPENSUSE-SU-2025:15713-1OPENSUSE-SU-2025:15742-1OPENSUSE-SU-2025:15748-1OPENSUSE-SU-2025:15750-1OPENSUSE-SU-2025:15760-1OPENSUSE-SU-2025:15768-1OPENSUSE-SU-2025:15792-1OPENSUSE-SU-2026:20081-1RHSA-2025:23342RHSA-2025:23530RHSA-2026:0123RHSA-2026:7443RHSA-2026:7661RHSA-2026:8822RHSA-2026:8824SUSE-SU-2025:21199-1SUSE-SU-2025:21207-1SUSE-SU-2025:4221-1SUSE-SU-2025:4257-1SUSE-SU-2025:4257-2SUSE-SU-2025:4258-1SUSE-SU-2025:4277-1SUSE-SU-2025:4297-1SUSE-SU-2025:4352-1SUSE-SU-2025:4368-1SUSE-SU-2025:4389-1SUSE-SU-2025:4398-1SUSE-SU-2025:4487-1SUSE-SU-2026:0133-1SUSE-SU-2026:20125-1SUSE-SU-2026:20154-1USN-7886-1USN-7886-2CGA-38XQ-JHR9-7P8PCGA-VF3R-JMRX-6V96
Timeline
- 07-10-2025PublishedVulnerability first disclosed.
- 31-07-2026Last modifiedVulnerability information updated.
Description
The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations. Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.
CVSS metrics
7 scores · 7 sources · 1 versionMedium 4.3Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:NSourcesAll 7 agree
- OSV · Red hatEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- OSV · DebianEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
- NVDNIST4.3MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
39%
Versus all other CVEs
30-day change
+0.09 pp
From 0.38% on 18-09-2026
18-09-202618-10-2026
EPSS score0.47%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundSecurity Research
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Redhat17 products
- python-unversioned-command< 0:3.12.12-1.el10_1 | < 0:3.12.9-2.el10_0.4
- python3< 0:3.12.12-1.el10_1 | < 0:3.12.9-2.el10_0.4
- python3-debug< 0:3.12.12-1.el10_1 | < 0:3.12.9-2.el10_0.4
- python3-devel< 0:3.12.12-1.el10_1 | < 0:3.12.9-2.el10_0.4
- python3-idle< 0:3.12.12-1.el10_1 | < 0:3.12.9-2.el10_0.4
Ubuntu12 products
- python2.7All versions (No fix recorded)
- python3.10< 3.10.12-1~22.04.12
- python3.11< 3.11.0~rc1-1~22.04.1~esm6
- python3.12< 3.12.3-1ubuntu0.9
- python3.13< 3.13.7-1ubuntu0.1
Chainguard6 products
- python-3.10< 3.10.19-r0
- python-3.11< 3.11.14-r0
- python-3.12< 3.12.12-r0
- python-3.13< 3.13.8-r1
- python-3.14< 3.14.0-r2
Debian5 products
- jythonAll versions (No fix recorded)
- pypy3All versions (No fix recorded) | < 7.3.21+dfsg-1
- python3.11< 3.11.2-6+deb12u7
- python3.13< 3.13.5-2+deb13u1 | < 3.13.11-1
- python3.14< 3.14.0-3
Wolfi5 products
- python-3.10< 3.10.19-r0
- python-3.11< 3.11.14-r0
- python-3.12< 3.12.12-r0
- python-3.13< 3.13.8-r1
- python-3.14< 3.14.0-r2
Suse4 products
- python-base&distro=SUSE Linux Enterprise Module for Package Hub 15 SP6< 2.7.18-150000.86.1
- python-base&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 2.7.18-150000.86.1
- python&distro=SUSE Linux Enterprise Module for Package Hub 15 SP6< 2.7.18-150000.86.1
- python&distro=SUSE Linux Enterprise Module for Package Hub 15 SP7< 2.7.18-150000.86.1
Opensuse3 products
- python-base&distro=openSUSE Leap 15.6< 2.7.18-150000.86.1
- python-doc&distro=openSUSE Leap 15.6< 2.7.18-150000.86.1
- python&distro=openSUSE Leap 15.6< 2.7.18-150000.86.1
Python software foundation1 product
- cpython< 3.9.24 | ≥ 3.10.0, < 3.10.19 | ≥ 3.11.0, < 3.11.14 | ≥ 3.12.0, < 3.12.12 | ≥ 3.13.0, < 3.13.10 | ≥ 3.14.0, < 3.14.1
8 vendors · 53 products
References
37 links- mail.python.org/archives/list/security-announce@python.org/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/Vendor AdvisoryARTICLEREPORTAdvisory
Show all 37 references
- github.com/psf/advisory-database/blob/main/advisories/python/PSF-2025-12.jsonVendor AdvisoryAdvisory
- github.com/google/security-research/security/advisories/GHSA-hhv7-p4pg-wm6pTechnical DescriptionExploitEVIDENCE
- github.com/python/cpythonPACKAGE