Executive brief
The 'zipfile' module in Python, which is used by developers to read and write ZIP archive files, contains a flaw in how it processes large ZIP64 files. An attacker could create a specially crafted ZIP archive that Python handles differently than other standard ZIP tools. This discrepancy could be used to bypass security scanners or hide malicious content within archives that appear legitimate to other software.
Technical details
A vulnerability exists in the Python 'zipfile' module due to improper validation of the ZIP64 End of Central Directory (EOCD) Locator record offset. Instead of using the specified offset to locate the ZIP64 EOCD record, the module assumes the record is located immediately preceding the locator. An attacker can exploit this by crafting a ZIP archive with mismatched offsets, causing Python to interpret the archive structure differently than other ZIP parsers (CWE-1285). This could lead to security bypasses where malicious payloads are hidden from scanners but executed by Python applications. The fix ensures the offset specified in the locator record matches the expected internal value.
Affected products
- Python Software Foundation CPython 3.10.0 to 3.10.18, 3.11.0 to 3.11.13, 3.12.0 to 3.12.11, 3.13.0 to 3.13.9, 3.14.0 to 3.14.0
Timeline
- 2025-10-07: advisory
- 2025-10-07: patched
References
- https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267
- https://github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46
- https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6
- https://github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196
- https://github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4
- https://github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388
- https://github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3