CVE-2025-13837: Out-of-memory when loading Plist

Q: What is the severity of CVE-2025-13837?

CVE-2025-13837 has been classified as a high severity vulnerability due to its potential to cause out-of-memory (OOM) and Denial of Service (DoS) issues.

Q: How do I fix CVE-2025-13837?

To mitigate CVE-2025-13837, ensure you are using the latest patched version of Python Software Foundation Python and plistlib.

Q: What impact does CVE-2025-13837 have on my application?

CVE-2025-13837 can lead to application crashes or service downtime if a malicious plist file is processed.

Q: Is CVE-2025-13837 a remote code execution vulnerability?

CVE-2025-13837 does not allow for remote code execution but can cause denial of service due to resource exhaustion.

Q: Which versions of Python are affected by CVE-2025-13837?

CVE-2025-13837 affects all versions of Python that utilize the plistlib module without the necessary safeguards against malicious file inputs.

Published Dec 1, 2025

Updated

Out-of-memory when loading Plist

Other sources

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

— MITRE

Affected Software

34 affected componentsFixes available

Python Software Foundation Python

Python Software Foundation plistlib

Microsoft cbl2 python3 3.9.19-16

Microsoft azl3 python3 3.12.9-5

Microsoft azl3 tensorflow 2.16.1-9

Microsoft cbl2 python3 3.9.19-17

Microsoft azl3 python3 3.12.9-6

Python Python<3.13.10

Python Python>=3.14.0<3.14.1

Python Python=3.15.0-alpha1

Python Python=3.15.0-alpha2

IBM Concert Software<=1.0-3.0.0

All of the following

azurelinux/python3<3.9.19-20

3.9.19-20

Microsoft CBL-Mariner=2.0

All of the following

azurelinux/python3<3.12.9-7

3.12.9-7

Microsoft Azure Linux=3.0

All of the following

azurelinux/python3=3.9.19-16

Microsoft CBL-Mariner=2.0

All of the following

azurelinux/tensorflow=2.16.1-9

Microsoft Azure Linux=3.0

All of the following

azurelinux/python3=3.9.19-17

Microsoft CBL-Mariner=2.0

All of the following

azurelinux/python3=3.12.9-5

Microsoft Azure Linux=3.0

debian/pypy3*

debian/pypy3<7.3.21+dfsg-1

7.3.21+dfsg-1

debian/python3.11<3.11.2-6+deb12u7

3.11.2-6+deb12u7

debian/python3.13<3.13.5-2+deb13u1

3.13.5-2+deb13u1

debian/python3.14<3.14.2-1

3.14.2-1

debian/pypy3<=7.3.11+dfsg-2+deb12u3, <=7.3.19+dfsg-2

8.0.1+dfsg-1

debian/python3.11

3.11.2-6+deb12u83.11.2-6+deb12u9

debian/python3.13

3.13.5-2+deb13u53.13.18-1

debian/python3.14

3.14.10-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade azurelinux/python3 to a version that resolves this vulnerability.
Fixed in 3.9.19-20
Upgrade
Upgrade azurelinux/python3 to a version that resolves this vulnerability.
Fixed in 3.12.9-7
Upgrade
Upgrade debian/pypy3 to a version that resolves this vulnerability.
Fixed in 7.3.21+dfsg-1
Upgrade
Upgrade debian/python3.11 to a version that resolves this vulnerability.
Fixed in 3.11.2-6+deb12u7
Upgrade
Upgrade debian/python3.13 to a version that resolves this vulnerability.
Fixed in 3.13.5-2+deb13u1
Upgrade
Upgrade debian/python3.14 to a version that resolves this vulnerability.
Fixed in 3.14.2-1
Upgrade
Upgrade debian/pypy3 to a version that resolves this vulnerability.
Fixed in 8.0.1+dfsg-1
Upgrade
Upgrade debian/python3.11 to a version that resolves this vulnerability.
Fixed in 3.11.2-6+deb12u8Fixed in 3.11.2-6+deb12u9
Upgrade
Upgrade debian/python3.13 to a version that resolves this vulnerability.
Fixed in 3.13.5-2+deb13u5Fixed in 3.13.18-1
Upgrade
Upgrade debian/python3.14 to a version that resolves this vulnerability.
Fixed in 3.14.10-1

Event History

Dec 1, 2025

CVE Published

via MITRE·06:13 PM

Data Sourced

via MITRE·06:13 PM

Description

Data Sourced

via OSV·06:13 PM

DescriptionSeverity

Data Sourced

via NVD·06:16 PM

RemedyDescriptionSeverityWeaknessAffected Software

Data Sourced

via OSV·06:16 PM

Affected Software

Data Sourced

via Red Hat·07:01 PM

DescriptionSeverityAffected Software

Dec 5, 2025

Data Sourced

via Microsoft·01:03 AM

DescriptionSeverityWeaknessAffected Software

Oct 14, 2026

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

IBM-7292374

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-4445-1

Frequently Asked Questions

What is the severity of CVE-2025-13837?

CVE-2025-13837 has been classified as a high severity vulnerability due to its potential to cause out-of-memory (OOM) and Denial of Service (DoS) issues.

How do I fix CVE-2025-13837?

To mitigate CVE-2025-13837, ensure you are using the latest patched version of Python Software Foundation Python and plistlib.

What impact does CVE-2025-13837 have on my application?

CVE-2025-13837 can lead to application crashes or service downtime if a malicious plist file is processed.

Is CVE-2025-13837 a remote code execution vulnerability?

CVE-2025-13837 does not allow for remote code execution but can cause denial of service due to resource exhaustion.

Which versions of Python are affected by CVE-2025-13837?

CVE-2025-13837 affects all versions of Python that utilize the plistlib module without the necessary safeguards against malicious file inputs.

CVE-2025-13837: Out-of-memory when loading Plist

Other sources

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2025-13837?

How do I fix CVE-2025-13837?

What impact does CVE-2025-13837 have on my application?

Is CVE-2025-13837 a remote code execution vulnerability?

Which versions of Python are affected by CVE-2025-13837?

Company

Resources

Contact