CVE-2026-44722

Name of the Vulnerable Software and Affected Versions pyzipper versions prior to 0.4.0

Description A Python operator precedence bug in pyzipper/zipfile aes.py prevents the AE-2 format from being automatically selected during encryption. Consequently, encrypted entries are written in AE-1 format unless AE-2 is explicitly forced. The AE-1 format stores the plaintext CRC32 checksum unencrypted in the ZIP header. Additionally, when writing to an unseekable zip archive, the CRC32 value is always written to the datadescripter section. An attacker with access to the archive can read the unencrypted CRC32 value and attempt to brute-force candidate plaintexts by comparing computed CRC32 values against the stored one. This is primarily feasible for small or low-entropy files.

Recommendations Upgrade to pyzipper version 0.4.0. If rewriting the zip archive to remove CRC values for small files, recreate the entire zip archive to ensure the original local file header containing the CRC is not left in a detached state.