CVE-2025-8291
ZIP64 End of Central Directory (EOCD) Locator record offset not checked
Description
The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations. Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.
INFO
Published Date :
Oct. 7, 2025, 6:16 p.m.
Last Modified :
Oct. 15, 2025, 4:15 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | MEDIUM | 28c92f92-d60d-412d-b760-e73465c3df22 | ||||
| CVSS 3.1 | MEDIUM | [email protected] |
Solution
- Apply the latest security patch for the zipfile module.
- Ensure the offset in ZIP64 EOCD Locator is valid.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2025-8291.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2025-8291 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2025-8291
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2025-8291 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2025-8291 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 15, 2025
Action Type Old Value New Value Added CWE CWE-1285 -
CVE Modified by [email protected]
Oct. 09, 2025
Action Type Old Value New Value Added Reference https://github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46 Added Reference https://github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196 Added Reference https://github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4 Added Reference https://github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388 Added Reference https://github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3 -
CVE Modified by [email protected]
Oct. 07, 2025
Action Type Old Value New Value Added Reference https://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267 Added Reference https://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6 Added Reference https://github.com/python/cpython/issues/139700 -
New CVE Received by [email protected]
Oct. 07, 2025
Action Type Old Value New Value Added Description The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations. Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value. Added CVSS V3.1 AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Added Reference https://github.com/python/cpython/pull/139702 Added Reference https://mail.python.org/archives/list/[email protected]/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/