CVE-2025-13837

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-13837
When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b Patch
https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70 Patch
https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba Patch
https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb Patch
https://github.com/python/cpython/issues/119342 Issue Tracking Patch
https://github.com/python/cpython/pull/119343 Issue Tracking Patch
https://mail.python.org/archives/list/security-announce@python.org/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/ Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*
History

15 Jan 2026, 19:08

Type Values Removed Values Added
First Time Python
Python python
References () https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b - () https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b - Patch
References () https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70 - () https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70 - Patch
References () https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba - () https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba - Patch
References () https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb - () https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb - Patch
References () https://github.com/python/cpython/issues/119342 - () https://github.com/python/cpython/issues/119342 - Issue Tracking, Patch
References () https://github.com/python/cpython/pull/119343 - () https://github.com/python/cpython/pull/119343 - Issue Tracking, Patch
References () https://mail.python.org/archives/list/security-announce@python.org/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/ - () https://mail.python.org/archives/list/security-announce@python.org/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/ - Vendor Advisory
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CPE cpe:2.3:a:python:python:3.15.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:python:python:3.15.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
Summary
  • (es) Al cargar un archivo plist, el módulo plistlib lee datos en un tamaño especificado por el propio archivo, lo que significa que un archivo malicioso puede causar problemas de OOM y DoS.

07 Jan 2026, 16:15

Type Values Removed Values Added
CWE CWE-400

22 Dec 2025, 20:15

Type Values Removed Values Added
References
  • () https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b -

02 Dec 2025, 18:15

Type Values Removed Values Added
References
  • () https://mail.python.org/archives/list/security-announce@python.org/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/ -

01 Dec 2025, 19:15

Type Values Removed Values Added
References
  • () https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70 -
  • () https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba -
  • () https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb -

01 Dec 2025, 18:16

Type Values Removed Values Added
New CVE
Information

Published : 2025-12-01 18:16

Updated : 2026-01-15 19:08

NVD link : CVE-2025-13837

Mitre link : CVE-2025-13837

CVE.ORG link : CVE-2025-13837

JSON object : View

Products Affected

python

  • python
CWE
CWE-400

Uncontrolled Resource Consumption