A Python operator precedence error in pyzipper/zipfile_aes.py before version 0.4.0 caused the AE‑2 encryption mode to be bypassed, resulting in files being encrypted with the weaker AE‑1 format. This leaves the plaintext CRC32 checksum visible in the ZIP header and, for unseekable archives, also in the data descriptor, enabling an attacker who has the archive to brute‑force small or low‑entropy files by comparing CRC32 values. The weakness is classified as CWE‑480.

Python developers and users employing the danifus:pyzipper library, specifically any installation of pyzipper earlier than version 0.4.0. The bug applies to all files encrypted with the library when AE‑1 was inadvertently used. No other vendor or product is affected.

The problem has a CVSS score of 6.2 and an EPSS score of less than 1 %, indicating that the risk is moderate but classic exploitation scenarios are unlikely at present. The vulnerability is not listed in CISA’s KEV catalog. Attackers need only possess the affected ZIP archive; if low entropy, they can compute CRC32 hashes of candidate strings until a match is found. An exploit path is straightforward for a skilled attacker but unlikely to be automated widely.