CVE-2025-4516 Use-after-free in "unicode_escape" decoder with error handler
A use-after-free vulnerability in CPython's unicode_escape decoder allows attackers to cause crashes or execute code when specific error handlers are used.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-4516?
CVE-2025-4516 is a medium-severity use after free vulnerability in CPython, published on 15 May 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.
Weakness: CWE-416
Which versions are affected by CVE-2025-4516?
3 open source packages ship an affected version, including libpython, python and python-min.
| Package | Affected | Fixed in |
|---|---|---|
libpython Bitnami | All versions | 3.9.23, 3.10.18, 3.11.13, 3.12.11, 3.13.4 |
python Bitnami | All versions | 3.9.23, 3.10.18, 3.11.13, 3.12.11, 3.13.4 |
python-min Bitnami | All versions | 3.9.23, 3.10.18, 3.11.13, 3.12.11, 3.13.4 |
Linux distribution packages (10)
python3 SUSE:Linux Enterprise Micro 5.1 | All versions | 3.6.15-150000.3.176.1 |
python3 SUSE:Linux Enterprise Micro 5.1 | All versions | 3.6.15-150000.3.179.1 |
python3-core SUSE:Linux Enterprise Micro 5.1 | All versions | 3.6.15-150000.3.176.1 |
python3-core SUSE:Linux Enterprise Micro 5.1 | All versions | 3.6.15-150000.3.179.1 |
python310 openSUSE:Tumbleweed | All versions | 3.10.17-4.1 |
python311 openSUSE:Tumbleweed | All versions | 3.11.12-4.1 |
python312 openSUSE:Tumbleweed | All versions | 3.12.10-4.1 |
python313 openSUSE:Tumbleweed | All versions | 3.13.3-3.1 |
python314 openSUSE:Tumbleweed | All versions | 3.14.0~b1-3.1 |
python39 openSUSE:Tumbleweed | All versions | 3.9.22-3.1 |
How do I fix CVE-2025-4516?
Upgrade libpython to a fixed version for your release line: 3.9.23, 3.10.18, 3.11.13 or 3.12.11.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2025-4516 being exploited?
There is no known exploitation of CVE-2025-4516 in the wild and no public exploit code.
Sources
Also known as ALPINE-CVE-2025-4516, AZL-61865, AZL-61870, BELL-CVE-2025-4516, BIT-libpython-2025-4516, BIT-python-2025-4516 and 24 more.