PT-2025-41152 · Python+9 · Python+9

Caleb Brown + 2 · CVE-2025-8291 · Published 2025-07-28 · Updated 2026-07-31

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Python versions prior to 2.3

Description The 'zipfile' module does not validate the ZIP64 End of Central Directory (EOCD) Locator record offset value, leading to potential discrepancies in how ZIP archives are handled compared to other ZIP implementations. Specifically, the module incorrectly assumes the ZIP64 EOCD record's location, potentially allowing crafted ZIP archives to be processed in an unexpected manner.

Recommendations Update to version 2.3 or later.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1285

Related Identifiers

ALSA-2025:23323

ALSA-2025:23342

ALSA-2025:23530

ALSA-2025:23940

ALSA-2026:0123

AZL-68318

AZL-68321

BDU:2026-00313

BIT-LIBPYTHON-2025-8291

BIT-PYTHON-2025-8291

BIT-PYTHON-MIN-2025-8291

CVE-2025-8291

DLA-4354-1

ECHO-37A0-326B-4E55

GHSA-HHV7-P4PG-WM6P

OESA-2025-2574

OESA-2025-2575

OESA-2025-2576

OESA-2025-2577

OESA-2025-2578

OPENSUSE-SU-2025:15713-1

OPENSUSE-SU-2025:15742-1

OPENSUSE-SU-2025:15748-1

OPENSUSE-SU-2025:15750-1

OPENSUSE-SU-2025:15760-1

OPENSUSE-SU-2025:15768-1

OPENSUSE-SU-2025:15792-1

OPENSUSE-SU-2026:20081-1

PSF-2025-12

RHSA-2025:23323

RHSA-2025:23940

RHSA-2026:0123

RHSA-2026:0353

RHSA-2026:0354

RHSA-2026:0355

RHSA-2026:7443

RHSA-2026:7661

RHSA-2026:8822

RHSA-2026:8824

SUSE-SU-2025:21199-1

SUSE-SU-2025:21207-1

SUSE-SU-2025:4221-1

SUSE-SU-2025:4257-1

SUSE-SU-2025:4257-2

SUSE-SU-2025:4258-1

SUSE-SU-2025:4277-1

SUSE-SU-2025:4297-1

SUSE-SU-2025:4313-1

SUSE-SU-2025:4352-1

SUSE-SU-2025:4368-1

SUSE-SU-2025:4389-1

SUSE-SU-2025:4398-1

SUSE-SU-2025:4487-1

SUSE-SU-2026:0133-1

SUSE-SU-2026:20125-1

SUSE-SU-2026:20154-1

USN-7886-1

USN-7886-2

Affected Products

Almalinux

Centos

Debian

Linuxmint

Python

Red Hat

Red Os

Rocky Linux

Suse

Ubuntu

References · 207

• 🔥 https://github.com/google/security-research/security/advisories/GHSA-hhv7-p4pg-wm6p · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8291.json · Exploit
• https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6 · Patch
• https://github.com/python/cpython/pull/139702 · Patch
• https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267 · Patch
• https://github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3 · Patch
• https://github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4 · Patch
• https://github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46 · Patch
• https://github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388 · Patch
• https://github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196 · Patch
• https://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2025-12.json · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4257-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-8291 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-9287 · Security Note
• https://linux.oracle.com/errata/ELSA-2025-23530.html · Vendor Advisory