CVE-2025-8291
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk28th percentile - higher than 28% of all known CVEs
Summary
The 'zipfile' module in Python did not validate the offset value in the ZIP64 EOCD Locator record. Instead, it assumed the ZIP64 EOCD record is the previous record. This can be abused to create ZIP archives handled differently by 'zipfile' compared to other ZIP implementations. The fix maintains this behavior but checks that the offset matches the expected value.
Risk Assessment
Risk of inconsistency in ZIP archive handling, potentially leading to security bypass or data processing errors.
Recommendation
Update Python to a version containing the fix for the zipfile module.
Original NVD description (English source)
The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations. Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.