Use After Free in Python Software Foundation Cpython
CVE-2025-4516
There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop usi…
Vulnerability class: Use-After-Free
EPSS: 0.002 (6.6th percentile) — read the EPSS interpretation.
Affected products
- Python Software Foundation Cpython — versions 0, 3.11.0, 3.12.0
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cna@python.org (issue-tracking)
- cna@python.org (patch)
- cna@python.org (vendor-advisory)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
- cna@python.org (patch)
Frequently asked questions
- What is CVE-2025-4516?
- CVE-2025-4516 is a vulnerability in Python Software Foundation Cpython, classified under Use After Free. Published 2025-05-15.
- Is CVE-2025-4516 known to be exploited?
- 4 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.