Is CVE-2025-8291 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2025-8291 being exploited in the wild.

How severe is CVE-2025-8291?

Medium severity, with a CVSS score of 4.3, published 7 October 2025.

Which products and versions are affected?

Python Software Foundation CPython 3.10.0 to 3.10.18, 3.11.0 to 3.11.13, 3.12.0 to 3.12.11, 3.13.0 to 3.13.9, 3.14.0 to 3.14.0.

Is there a fix for CVE-2025-8291?

A patch was published on 2025-10-07. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2025-8291 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2025-8291?

Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2025-8291: Python CPython improper offset validation in zipfile module

CVE-2025-8291 · Severity: medium · CVSS 4.3 · Published 2025-10-07

The 'zipfile' module in Python, which is used by developers to read and write ZIP archive files, contains a flaw in how it processes large ZIP64 files. An attacker could create a specially crafted ZIP archive that Python handles differently than other standard ZIP tools. This discrepancy could be used to bypass security scanners or hide malicious content within archives that appear legitimate to other software.

Technologies: Python Software Foundation CPython. Vendors: Python Software Foundation.

Quick answers

Is CVE-2025-8291 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2025-8291 being exploited in the wild.
How severe is CVE-2025-8291?: Medium severity, with a CVSS score of 4.3, published 7 October 2025.
Which products and versions are affected?: Python Software Foundation CPython 3.10.0 to 3.10.18, 3.11.0 to 3.11.13, 3.12.0 to 3.12.11, 3.13.0 to 3.13.9, 3.14.0 to 3.14.0.
Is there a fix for CVE-2025-8291?: A patch was published on 2025-10-07. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-8291 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2025-8291?: Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the Python 'zipfile' module due to improper validation of the ZIP64 End of Central Directory (EOCD) Locator record offset. Instead of using the specified offset to locate the ZIP64 EOCD record, the module assumes the record is located immediately preceding the locator. An attacker can exploit this by crafting a ZIP archive with mismatched offsets, causing Python to interpret the archive structure differently than other ZIP parsers (CWE-1285). This could lead to security bypasses where malicious payloads are hidden from scanners but executed by Python applications. The fix ensures the offset specified in the locator record matches the expected internal value.

Affected products

Python Software Foundation CPython 3.10.0 to 3.10.18, 3.11.0 to 3.11.13, 3.12.0 to 3.12.11, 3.13.0 to 3.13.9, 3.14.0 to 3.14.0

Timeline

2025-10-07: advisory
2025-10-07: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.