Use After Free in Python Software Foundation Cpython
CVE-2025-4516
There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.
Vulnerability class: Use-After-Free
Published · last modified .
EPSS exploit prediction
EPSS: 0.002 (10.8th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 11th percentile — 10.8% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.002 · newest: 0.002 · change: 0.000
Affected products
- Python Software Foundation Cpython — versions 3.10.0, 0, 3.14.0a1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- github.com/python/cpython/issues/133767 (issue-tracking)
- github.com/python/cpython/pull/129648 (patch)
- mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF… (vendor-advisory)
- github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142 (patch)
- github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e (patch)
- github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292 (patch)
- github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d (patch)
- github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f (patch)
- github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77 (patch)
- github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b (patch)
Frequently asked questions
- What is CVE-2025-4516?
- CVE-2025-4516 is a vulnerability in Python Software Foundation Cpython, classified under Use After Free. Published 2025-05-15.
- Is CVE-2025-4516 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.