CVSS 4.0
2.1 lowCVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:L/SA:NCVE-2025-13837
Low (2.1) in python python. EPSS 0.2% chance of exploitation in the next 30 days.
When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues
Severity
CVSS 3.1
5.5 mediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
- CWE
- CWE-400
- Published
- Modified
- Record from
- the NVD, synced
Affected
- python:python
References
- https://github.com/python/cpython/commit/568342cfc8f002d9a15f30238f26b9d2e0e79036
- https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2b
- https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70
- https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1ba
- https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cb