PSF-2025-15: Out-of-memory when loading Plist

Published Dec 1, 2025

Updated

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

Affected Software

1 affected component

Python Software Foundation Python plistlib

Event History

Dec 1, 2025

CVE Published

via OSV·06:13 PM

Data Sourced

via OSV·06:13 PM

DescriptionSeverity

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs to cause the application to load a malicious plist file. The file can specify a data size that causes plistlib to consume excessive memory, leading to an out-of-memory condition and denial of service.

Which deployments are most exposed?

Applications that use Python's plistlib module to load plist files from untrusted or attacker-controlled sources are exposed. The provided information does not identify specific affected Python versions or configurations.

What can be done if patching is not immediately possible?

Avoid loading untrusted plist files with plistlib, or validate and restrict plist inputs before loading them. Apply resource limits to the process where possible to reduce the impact of memory exhaustion.

PSF-2025-15: Out-of-memory when loading Plist

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments are most exposed?

What can be done if patching is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

Which deployments are most exposed?

What can be done if patching is not immediately possible?