CVE-2025-8291: ZIP64 End of Central Directory (EOCD) Locator record offset not checked
The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.
Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.
Other sources
ZIP64 End of Central Directory (EOCD) Locator record offset not checked
— Microsoft
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-8291?
CVE-2025-8291 is classified as a high severity vulnerability due to potential exploitation leading to arbitrary code execution.
How do I fix CVE-2025-8291?
To fix CVE-2025-8291, update to the latest version of the Python 'zipfile' module where the vulnerability has been patched.
What is the impact of CVE-2025-8291?
The impact of CVE-2025-8291 includes potential data corruption or arbitrary code execution if malformed ZIP files are processed.
Who is affected by CVE-2025-8291?
CVE-2025-8291 affects all applications using the Python Software Foundation's 'zipfile' module without proper input validation on ZIP64 files.
Is CVE-2025-8291 being actively exploited?
As of now, there are no confirmed reports of active exploitation for CVE-2025-8291, but vigilance is advised.