PSF-2026-10

UNKNOWN

Published Mar 12, 2026

Modified Yesterday

Fix available

Details

The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.

Affected Packages

Python

Windows 10 (1507)Windows 10 (1607) / Server 2016Windows 10 (1809) / Server 2019Windows 10 (1903)Windows 10 (1909)

Fixed in:

3.15.0

References

REPORT

https://github.com/python/cpython/issues/141707

WEB

https://github.com/python/cpython/pull/143934

ADVISORY

https://mail.python.org/archives/list/security-announce@python.org/thread/EOMI5I66ZMKQ2INNFT6T7IAIKUGPZYIE/

Aliases

CVE-2025-13462

Ecosystems(20)

Windows 10 (1507)Windows 10 (1607) / Server 2016 Windows 10 (1809) / Server 2019 Windows 10 (1903)Windows 10 (1909)

Timeline

PublishedMar 12, 2026

ModifiedMar 12, 2026