CVE-2025-4516: Use-after-free in "unicode_escape" decoder with error handler
There is an issue in CPython when using bytes.decode("unicodeescape", error="ignore|replace"). If you are not using the "unicodeescape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.
Other sources
Use-after-free in "unicodeescape" decoder with error handler
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.9.19-14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-2
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4516?
CVE-2025-4516 is considered a medium severity vulnerability as it affects the handling of byte decoding in CPython.
How do I fix CVE-2025-4516?
To mitigate CVE-2025-4516, avoid using the 'unicode_escape' encoding with an error handler by wrapping the bytes in a try-except block instead.
Who is affected by CVE-2025-4516?
Users of CPython who utilize the 'bytes.decode' method with 'unicode_escape' encoding and specific error handlers are directly affected by CVE-2025-4516.
What versions of CPython are impacted by CVE-2025-4516?
CVE-2025-4516 affects all active versions of CPython that utilize the 'bytes.decode' method incorrectly with 'unicode_escape' encoding.
Is there a workaround for CVE-2025-4516?
Yes, a workaround for CVE-2025-4516 involves avoiding the use of the error handler in the 'bytes.decode' method.