Use-after-free in "unicode_escape" decoder with error handler
Published May 15, 2025
5.9
MEDIUMCVSS 4.0
EPSS 0.22%
Description
There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.
Affected products
-
- Version 0StatusaffectedConstraints<3.9.23
- Version 3.10.0StatusaffectedConstraints<3.10.18
- Version 3.11.0StatusaffectedConstraints<3.11.13
- Version 3.12.0StatusaffectedConstraints<3.12.11
- Version 3.13.0StatusaffectedConstraints<3.13.4
- Version 3.14.0a1StatusaffectedConstraints<3.14.0b2
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Python Software Foundation | CPython | unaffected |
|
No data.
No data.
Red Hat Enterprise Linux 8
python39-devel:3.9-8100020251126112422.d47b87a4
Fixed · RHSA-2025:23530
Red Hat Enterprise Linux 8
python39:3.9-8100020251126112422.d47b87a4
Fixed · RHSA-2025:23530
Red Hat Enterprise Linux 10
python3.12
Fix deferred
Red Hat Enterprise Linux 6
python
Out of support scope
Red Hat Enterprise Linux 7
python
Fix deferred
Red Hat Enterprise Linux 7
python3
Fix deferred
Red Hat Enterprise Linux 8
python3
Fix deferred
Red Hat Enterprise Linux 8
python3.11
Fix deferred
Red Hat Enterprise Linux 8
python3.12
Fix deferred
Red Hat Enterprise Linux 8
python36:3.6/python36
Fix deferred
Red Hat Enterprise Linux 9
python3.11
Fix deferred
Red Hat Enterprise Linux 9
python3.12
Fix deferred
Red Hat Enterprise Linux 9
python3.9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)
rhelai1/bootc-amd-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)
rhelai1/bootc-aws-nvidia-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)
rhelai1/bootc-azure-amd-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)
rhelai1/bootc-azure-nvidia-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)
rhelai1/bootc-gcp-nvidia-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)
rhelai1/bootc-intel-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)
rhelai1/bootc-nvidia-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)
rhelai1/granite-3.1-8b-lab-v2.1
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)
rhelai1/granite-3.1-8b-starter-v2.1
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)
rhelai1/instructlab-amd-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)
rhelai1/instructlab-nvidia-rhel9
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)
rhelai1/modelcar-granite-3-1-8b-lab-v2-1
Fix deferred
Red Hat Enterprise Linux AI (RHEL AI)
rhelai1/modelcar-granite-3-1-8b-starter-v2-1
Fix deferred
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat Enterprise Linux 8 | python39-devel:3.9-8100020251126112422.d47b87a4 | Fixed | RHSA-2025:23530 |
| Red Hat Enterprise Linux 8 | python39:3.9-8100020251126112422.d47b87a4 | Fixed | RHSA-2025:23530 |
| Red Hat Enterprise Linux 10 | python3.12 | Fix deferred | n/a |
| Red Hat Enterprise Linux 6 | python | Out of support scope | n/a |
| Red Hat Enterprise Linux 7 | python | Fix deferred | n/a |
| Red Hat Enterprise Linux 7 | python3 | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | python3 | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | python3.11 | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | python3.12 | Fix deferred | n/a |
| Red Hat Enterprise Linux 8 | python36:3.6/python36 | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | python3.11 | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | python3.12 | Fix deferred | n/a |
| Red Hat Enterprise Linux 9 | python3.9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) | rhelai1/bootc-amd-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) | rhelai1/bootc-aws-nvidia-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) | rhelai1/bootc-azure-amd-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) | rhelai1/bootc-azure-nvidia-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) | rhelai1/bootc-gcp-nvidia-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) | rhelai1/bootc-intel-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) | rhelai1/bootc-nvidia-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) | rhelai1/granite-3.1-8b-lab-v2.1 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) | rhelai1/granite-3.1-8b-starter-v2.1 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) | rhelai1/instructlab-amd-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) | rhelai1/instructlab-nvidia-rhel9 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) | rhelai1/modelcar-granite-3-1-8b-lab-v2-1 | Fix deferred | n/a |
| Red Hat Enterprise Linux AI (RHEL AI) | rhelai1/modelcar-granite-3-1-8b-starter-v2-1 | Fix deferred | n/a |
No package ranges for this CVE.
Remediation
Red Hat mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Metrics
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
1 other source (NVD) ▾
CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
No CVSS v3.0 score for this CVE.
No CVSS v2.0 score for this CVE.
This CVE is not in the KEV list.
CISA SSVC (Vulnrichment)
Stakeholder-Specific Vulnerability Categorization from CISA ADP.
Exploitation
NoneAutomatable
NoTechnical Impact
PartialDecision
n/aAssessed May 15, 2025 · SSVC 2.0.3
Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.
Score over time
2025–2026- EPSS v4
- EPSS v5
Percentile over time
- EPSS v4
- EPSS v5
Table of values (3 key points)
Flat stretches are collapsed; showing up to 120 newest points.
| Date | Score | Percentile | Model |
|---|---|---|---|
| Oct 3, 2026 | 0.22% (0.00216) | 10.92th | v5 (v2026.06.15) |
| Jun 15, 2026 | 0.17% (0.00169) | 6.57th | v5 (v2026.06.15) |
| May 16, 2025 | 0.01% (0.00014) | 1.64th | v4 (v2025.03.14) |
References (16)
- http://www.openwall.com/lists/oss-security/2025/05/16/4
- http://www.openwall.com/lists/oss-security/2025/05/19/1
- https://access.redhat.com/security/cve/CVE-2025-4516 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2366509 Issue Tracking
- https://github.com/python/cpython/commit/4398b788ffc1f954a2c552da285477d42a571292 patch
- https://github.com/python/cpython/commit/6279eb8c076d89d3739a6edb393e43c7929b429d patch
- https://github.com/python/cpython/commit/69b4387f78f413e8c47572a85b3478c47eba8142 patch
- https://github.com/python/cpython/commit/73b3040f592436385007918887b7e2132aa8431f patch
- https://github.com/python/cpython/commit/8d35fd1b34935221aff23a1ab69a429dd156be77 patch
- https://github.com/python/cpython/commit/9f69a58623bd01349a18ba0c7a9cb1dad6a51e8e patch
- https://github.com/python/cpython/commit/ab9893c40609935e0d40a6d2a7307ea51aec598b patch
- https://github.com/python/cpython/issues/133767 issue-tracking
- https://github.com/python/cpython/pull/129648 patch
- https://mail.python.org/archives/list/security-announce@python.org/thread/L75IPBBTSCYEF56I2M4KIW353BB3AY74/ vendor-advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-4516
- https://www.cve.org/CVERecord?id=CVE-2025-4516
Change history (0)
No recorded changes yet.