CVE-2025-13462 in CPython
Summary
by MITRE • 03/12/2026
The "tarfile" module would still apply normalization of AREGTYPE (\x00) blocks to DIRTYPE, even while processing a multi-block member such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK. This could result in a crafted tar archive being misinterpreted by the tarfile module compared to other implementations.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/13/2026
The vulnerability identified as CVE-2025-13462 resides within the tarfile module of Python's standard library, specifically addressing how the module handles normalization of archive entries during processing of multi-block members. This issue manifests when the tarfile module encounters GNU tar format extensions such as GNUTYPE_LONGNAME or GNUTYPE_LONGLINK, which are used to store long filenames or symbolic links that exceed standard tar limits. The core problem occurs during the processing of these extended members where the module incorrectly applies AREGTYPE (null) block normalization logic to DIRTYPE entries, creating a deviation from expected tar archive behavior.
The technical flaw stems from an inconsistent handling of archive entry types within the tarfile module's internal parsing logic. When processing multi-block members, the module maintains certain normalization behaviors that are appropriate for AREGTYPE blocks but erroneously extends these same normalization rules to DIRTYPE entries. This discrepancy becomes particularly problematic when dealing with crafted tar archives that exploit the difference between how Python's tarfile module interprets these entries versus how other tar implementations handle the same archive structures. The vulnerability creates a potential mismatch in archive interpretation that could be leveraged to bypass security checks or manipulate archive contents in unexpected ways.
The operational impact of this vulnerability extends beyond simple parsing inconsistencies and could potentially enable malicious actors to craft tar archives that behave differently when processed by Python applications versus other tar tools. This divergence in behavior creates opportunities for attackers to exploit the difference in interpretation to perform unauthorized operations or circumvent security controls that rely on proper archive handling. The vulnerability is particularly concerning in environments where tar archives are processed automatically or where archive integrity checks are performed, as the inconsistent normalization could lead to unexpected outcomes in automated security systems or file extraction processes. This issue represents a deviation from the expected tar archive specification behavior and could affect applications that depend on consistent archive processing across different platforms and tools.
Mitigation strategies for this vulnerability should focus on updating to patched versions of Python where the tarfile module correctly handles the normalization of different entry types during multi-block member processing. System administrators and developers should ensure that all Python installations are updated to versions that address this specific inconsistency in archive entry type handling. Additionally, organizations should implement proper input validation and sanitization when processing tar archives, particularly in automated environments where archive contents are not fully trusted. The vulnerability aligns with CWE-129, which addresses improper handling of length values, and could potentially map to ATT&CK technique T1204.002 for exploitation through legitimate system services, though the primary risk lies in the inconsistent archive interpretation rather than direct execution capabilities.