The vulnerability allows attackers to craft zip files that contain bzip2, LZMA, or Zstandard compressed members. When a vulnerable Python interpreter decompresses such a file, it allocates memory based on the attacker‑controlled compressed size without enforcing the maximum length bound that normally limits the amount of data that can be read at a time. This can lead to excessive memory allocation and eventual exhaustion, potentially causing crashes or a denial of service.

The issue targets the CPython interpreter maintained by the Python Software Foundation. All versions of CPython that have not applied the mitigation present in the referenced pull request and issue may be vulnerable; the specific affected releases are not enumerated in the data provided.

The CVSS score is 2.1, indicating a low severity per the base metric. The EPSS score is unavailable, so the likelihood of exploitation is unclear. The vulnerability is not listed in the CISA KEV catalog and there are no known public exploits. The likely attack vector is the processing of a maliciously crafted zip file from an untrusted source; exploitation requires local or remote execution of Python’s zipfile module with such a file.