# CVE-2025-13462: Python CPython tarfile misinterpretation via GNU long name normalization

Source: https://junglewise.ai/threats/cve-2025-13462-python-cpython-tarfile-misinterpretation-via-gnu-long-name  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-12. Updated: 2026-06-04  
License: CC BY 4.0 with a link back

CVE-2025-13462 · Severity: info · CVSS 2 · Published 2026-03-12

A vulnerability in Python's standard library for handling compressed archives could allow a specially crafted file to be misinterpreted. This issue occurs when processing files with very long names, causing the library to incorrectly identify a regular file as a directory. This can lead to data corruption during file extraction or cause software to stop reading the archive prematurely, potentially impacting the reliability of automated deployment tools and package managers.

Technologies: [Python Software Foundation CPython](https://junglewise.ai/threats/technologies/cpython). Vendors: [Python Software Foundation](https://junglewise.ai/threats/vendors/python-software-foundation).

## Quick answers

**Is CVE-2025-13462 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-13462 being exploited in the wild.

**How severe is CVE-2025-13462?** Informational severity, with a CVSS score of 2, published 12 March 2026.

**Which products and versions are affected?** Python Software Foundation CPython 3.10, 3.11, 3.12, 3.13, 3.14.

**Is there a fix for CVE-2025-13462?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2025-13462 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2025-13462?** Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The 'tarfile' module in CPython contains a logic error in its header parsing routine. When processing multi-block members such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK, the module incorrectly applies normalization of AREGTYPE (\x00) blocks to DIRTYPE based on 'garbage' data in the secondary header. This root cause is located in the frombuf() function, which overrides the entry type to a directory. Consequently, the file offset is not updated correctly, often causing the parser to silently discard subsequent entries or fail with an exception. This can be exploited via a crafted tar archive to cause a denial of service (incomplete extraction) or bypass security checks that rely on accurate file type identification. Patches have been merged into CPython branches 3.10 through 3.14.

## Affected products

- Python Software Foundation CPython 3.10, 3.11, 3.12, 3.13, 3.14

## Timeline

- 2025-11-18: disclosed: Issue first reported on GitHub
- 2026-03-12: advisory: CVE published and NVD record created

## References

- [https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab](https://github.com/python/cpython/commit/42d754e34c06e57ad6b8e7f92f32af679912d8ab)
- [https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114](https://github.com/python/cpython/commit/72dde1016493c52abe857fc4a7bf6c40138b4114)
- [https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017](https://github.com/python/cpython/commit/7ad3093d76a748af55bdb1d2e8aad3638163b017)
- [https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406](https://github.com/python/cpython/commit/9a23b753552afa28e3a2f4d8863572fc66479406)
- [https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7](https://github.com/python/cpython/commit/ae99fe3a33b43e303a05f012815cef60b611a9c7)
- [https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084](https://github.com/python/cpython/commit/d10950739a78f54d0718d88fb5a868374603c084)
- [https://github.com/python/cpython/issues/141707](https://github.com/python/cpython/issues/141707)

## Related threats

- [Python gzip/tarfile/zipfile CLI module shadowing via sys.path](https://junglewise.ai/threats/cve-2026-115791-when-tarfile-or-zipfile-command-line-interface-cli-is-used-to)
- [Python CPython quadratic complexity in xml.etree XPath index predicates](https://junglewise.ai/threats/cve-2026-6879-python-cpython-quadratic-complexity-in-xml-etree-xpath-index)
- [Python CPython CPU denial of service in html.parser.HTMLParser](https://junglewise.ai/threats/cve-2026-15308-python-cpython-cpu-denial-of-service-in-html-parser-htmlparser)
- [Python CPython improper permission preservation in tarfile.extract](https://junglewise.ai/threats/cve-2026-4360-python-cpython-improper-permission-preservation-in-tarfile-extract)
- [Python CPython infinite loop in tarfile streaming mode](https://junglewise.ai/threats/cve-2026-11972-python-cpython-infinite-loop-in-tarfile-streaming-mode)