CVE-2025-8291Medium· 4.3▾ SunlitThe 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previo…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 31.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.4%
Last analysed / modified upstream
0.4% → 0.5%
The 'zipfile' module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value would not be used to locate the ZIP64 EOCD record, instead the ZIP64 EOCD record would be assumed to be the previous record in the ZIP archive. This could be abused to create ZIP archives that are handled differently by the 'zipfile' module compared to other ZIP implementations.
Remediation maintains this behavior, but checks that the offset specified in the ZIP64 EOCD Locator record matches the expected value.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-116174Medium· 5.9vllm: vllm: Denial of Service via invalid prompt token IDs in gRPC service (CVE-2026-116174)
CVE-2026-89410Medium· 5.1Out-of-bounds read in Z-Wave NCP SPI Handler
CVE-2026-96582Medium· 4.9Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser
CVE-2026-98856Medium· 4.4kernel: kprobes: Skip disarmed probes when checking optkprobe overlap (CVE-2026-98856)
CVE-2026-98599Medium· 6.7kernel: bpf: Reject non-negative offsets in stack_slot_obj_get_spi() (CVE-2026-98599)
CVE-2026-72244High· 7.8In the Linux kernel, the following vulnerability has been resolved: gpu/buddy: bail out of try_harder when alignment cannot be honoured The try_harder contiguous fallback could return a range whose start offset did not match the caller…