CVE-2025-8291

Exploitation

Public exploit code exists. CISA's assessment records a public proof of concept. That is not a report of exploitation in the wild.

SSVC decision

• ExploitationpocPublic proof-of-concept exploit code exists. Not a report of exploitation in the wild.
• AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
• Technical ImpactpartialSuccessful exploitation gives limited control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.35% probability of exploitation activity in the next 30 days.

EPSS percentile

Ranks above 28.2% of scored records. A rank, not a probability.

NVD base score

4.3 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

NVD analysis status

Deferred. NVD last modified this record on 2026-07-31.

Red Hat severity

Moderate. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

Published

2025-10-07 18:10Z11 MO AGO

Last updated

2026-07-31 14:01Z1 MO AGO

Reserved

2025-07-28

Assigning CNA

PSF

Record state

PUBLISHED

Severity

Medium (CVSS 4.3)

CNA CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Weaknesses

• CWE-1285Improper Validation of Specified Index, Position, or Offset in InputBase
• CWE-130Improper Handling of Length Parameter InconsistencyBase

Data version

5.2

Document digest

d47cfb461ac35d54ed7efff61350707e6b730d7424d804ec68dee964c33b58b4

• github.comhttps://github.com/python/cpython/pull/139702patch
• mail.python.orghttps://mail.python.org/archives/list/security-announce@python.org/thread/QECOPWMTH4VPPJAXAH2BGTA4XADOP62G/vendor-advisory
• github.comhttps://github.com/python/cpython/issues/139700issue-tracking
• github.comhttps://github.com/python/cpython/commit/162997bb70e067668c039700141770687bc8f267patch
• github.comhttps://github.com/python/cpython/commit/333d4a6f4967d3ace91492a39ededbcf3faa76a6patch
• github.comhttps://github.com/python/cpython/commit/1d29afb0d6218aa8fb5e1e4a6133a4778d89bb46patch
• github.comhttps://github.com/python/cpython/commit/76437ac248ad8ca44e9bf697b02b1e2241df2196patch
• github.comhttps://github.com/python/cpython/commit/8392b2f0d35678407d9ce7d95655a5b77de161b4patch
• github.comhttps://github.com/python/cpython/commit/bca11ae7d575d87ed93f5dd6a313be6246e3e388patch
• github.comhttps://github.com/python/cpython/commit/d11e69d6203080e3ec450446bfed0516727b85c3patch
• github.comhttps://github.com/psf/advisory-database/blob/main/advisories/python/PSF-2025-12.jsonvendor-advisory
• github.comhttps://github.com/google/security-research/security/advisories/GHSA-hhv7-p4pg-wm6ptechnical-descriptionexploit