CVE-2025-8291: ZIP64 End of Central Directory (EOCD) Locator record offset not checked
Python Software Foundation · CPython
Vendor fix available · Affected: Python Software Foundation CPython · Exploitation: unlikely (under 1%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Higher than 40% of scored CVEs
DescriptionCVE.org
The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations. Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Python Software Foundation · CPythonbefore 3.9.24; from 3.10.0 before 3.10.19; from 3.11.0 before 3.11.14; from 3.12.0 before 3.12.12; from 3.13.0 before 3.13.10; from 3.14.0 before 3.14.1
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Unlikely (under 1%). EPSS under 1%, or no score yet.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Weakness
- Improper Validation of Specified Index, Position, or Offset in Input · Input Validation and Logic
- Published
- October 2025
CoverageNo articles yet
No CyberSIXT article names CVE-2025-8291 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.