Executive brief
pyzipper is a Python library used to create and read AES-encrypted ZIP files. A logic error in the software causes it to include a digital fingerprint (CRC32) of the original file's contents in the encrypted archive's header. An attacker with access to the archive could use this fingerprint to guess and verify the contents of small or simple files, potentially exposing sensitive information despite the encryption.
Technical details
An operator precedence bug in 'pyzipper/zipfile_aes.py' prevents the AE-2 format from being automatically selected during encryption. Consequently, archives are written in AE-1 format, which stores the plaintext CRC32 checksum unencrypted in the ZIP header (and the data descriptor section for unseekable archives). While the AES encryption remains intact, an attacker possessing the archive can perform a brute-force attack against small or low-entropy files by comparing candidate plaintext CRC32 values against the leaked checksum. The vulnerability is fixed in version 0.4.0, which defaults to the AE-2 format and excludes CRC32 values.
Affected products
- danifus pyzipper < 0.4.0
Timeline
- 2026-05-14: patched: Version 0.4.0 released
- 2026-05-14: advisory: GitHub Security Advisory published
- 2026-07-17: disclosed: CVE-2026-44722 published to NVD