Executive brief
Python's plistlib module, used to read plist configuration files, can be forced to consume excessive memory when processing specially crafted files. An attacker who can provide a malicious plist file to an application that parses it can trigger an out-of-memory condition, causing the application to crash or become unresponsive—effectively a denial-of-service attack against systems that rely on plist parsing.
Technical details
The plistlib module in Python contains a resource exhaustion vulnerability in its binary plist parser. When reading data from a plist file, the module preallocates a bytes object of the size specified in the file, rather than reading in chunks. A malicious plist file can specify extremely large data sizes (e.g., gigabytes) in its headers, causing the read() operation to attempt to allocate that much memory upfront, resulting in out-of-memory (OOM) errors even if the actual file is small. The vulnerability affects all versions that use this pattern. The fix, applied via cherry-picked commits to Python 3.10 and 3.12+, changes the parsing logic to read data in smaller chunks (with a threshold of 1 MB), limiting peak memory consumption to roughly the size of the input file itself. No authentication or special privileges are required; the attacker needs only to cause the target application to parse a malicious plist file.
Affected products
- Python CPython 3.10 before patch, 3.12 before patch, and likely other versions
Timeline
- 2025-12-01: disclosed: CVE-2025-13837 published
- 2025-12-22: patched: Patch applied to Python 3.12 via commit 5a8b196
- 2026-03-02: patched: Patch applied to Python 3.10 via commit 568342c