Skip to main content

Early Access — Mondoo Vulnerability Intelligence is currently in preview.

Mondoo Vulnerability Intelligence

Curated by Mondoo Research, enhanced with AI

Resources

Search Vulnerabilities
Trending CVEs
Browse Ecosystems
Terminology
Blog

Open Source

cnquery
cnspec

Star us on GitHub!

Company

Mondoo Platform
About
Contact

© 2026 Mondoo, Inc.

Privacy Policy Terms of Service Imprint

Vulnerability Intelligence

CVE-2025-4516 | Mondoo Vulnerability Intelligence

CVE-2025-4516

MEDIUM5.9

Use-after-free in "unicode_escape" decoder with error handler

Published May 15, 2025

Modified 7 months ago

No fix available

Details

There is an issue in CPython when using bytes.decode("unicode_escape", error="ignore|replace"). If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

References

WEBhttp://www.openwall.com/lists/oss-security/2025/05/16/4 WEBhttp://www.openwall.com/lists/oss-security/2025/05/19/1 FIXhttps://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292 FIXhttps://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d FIXhttps://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142 FIXhttps://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f FIXhttps://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77 FIXhttps://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e FIXhttps://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b WEBhttps://github.com/python/cpython/issues/133767 FIXhttps://github.com/python/cpython/pull/129648 ADVISORYhttps://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/ADVISORYhttps://www.cve.org/CVERecord?id=CVE-2025-4516

CVSS Analysis

CVSS v4.0

5.9

Exploitability

Attack Vector

LocalAV:L

Attack Complexity

HighAC:H

Attack Requirements

PresentAT:P

Privileges Required

NonePR:N

User Interaction

NoneUI:N

Vulnerable System

Vuln. Confidentiality

NoneVC:N

Vuln. Integrity

NoneVI:N

Vuln. Availability

HighVA:H

Subsequent System

Subseq. Confidentiality

NoneSC:N

Subseq. Integrity

NoneSI:N

Subseq. Availability

NoneSA:N

5.9/CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Weakness Type (CWE)

Memory Safety

Ecosystems

Timeline

PublishedMay 15, 2025

ModifiedJun 3, 2025