CVE-2025-8291

Name of the Vulnerable Software and Affected Versions Python versions prior to 2.3

Description The 'zipfile' module does not validate the ZIP64 End of Central Directory (EOCD) Locator record offset value, leading to potential discrepancies in how ZIP archives are handled compared to other ZIP implementations. Specifically, the module incorrectly assumes the ZIP64 EOCD record's location, potentially allowing crafted ZIP archives to be processed in an unexpected manner.

Recommendations Update to version 2.3 or later.