Executive brief
Python's zipfile module can be exploited when processing specially crafted ZIP files compressed with bzip2, LZMA, or Zstandard algorithms. An attacker can provide a malicious archive that causes Python to pre-allocate excessive memory based on attacker-controlled values, potentially exhausting available system memory and causing the application to crash or become unavailable.
Technical details
The vulnerability exists in Python's zipfile decompression handling for bzip2, LZMA, and Zstandard compression methods. When decompressing these formats, the library uses an attacker-controlled uncompressed size value to pre-allocate memory buffers without proper bounds checking. An attacker can craft a ZIP archive with inflated decompression size metadata that causes the zipfile module to allocate massive amounts of RAM, leading to memory exhaustion and denial of service. The fix, referenced in CPython commits 1b424c0 and 31980e8, adds bounds to decompression memory allocation.
Affected products
- Python CPython <UNKNOWN>
Timeline
- 2026-08-25: disclosed