The zipfile module would not check the validity of the ZIP64 End of Central Directory (EOCD) Locator record offset value. Instead of using the offset to locate the ZIP64 EOCD record, the module assumed it was the previous record in the ZIP archive. This flaw can be abused to create ZIP archives that the CPython zipfile module interprets differently from other ZIP implementations. The resulting inconsistency may affect how applications process or rely on ZIP content, but it does not grant direct code execution.

This issue affects all Python Software Foundation CPython releases that use the standard zipfile module prior to the patch being merged, spanning every major CPython version that includes zipfile before the latest updates. The bug was introduced by commits in the CPython repository and is addressed in subsequent releases that include the validation of the EOCD Locator offset.

The CVSS score of 4.3 indicates a moderate impact, and the EPSS score of less than 1% implies a very low likelihood of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is inferred to be local or remote, depending on whether an attacker can supply ZIP archives to a Python application. Though no direct gain of system resources is provided, the inconsistency could be leveraged in combination with other logic flaws if an attacker controls the input ZIP data.