CPython up to 3.14.0a1 bytes.decode use after free

Summaryinfo

A vulnerability, which was classified as critical, was found in CPython. This affects the function bytes.decode. Such manipulation leads to use after free. This vulnerability is referenced as CVE-2025-4516. It is possible to launch the attack remotely. No exploit is available. You should upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in CPython. Affected by this issue is the function bytes.decode. The manipulation with an unknown input leads to a use after free vulnerability. Using CWE to declare the problem leads to CWE-416. Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code. Impacted is confidentiality, integrity, and availability. CVE summarizes:

There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

The advisory is shared for download at github.com. This vulnerability is handled as CVE-2025-4516 since 05/09/2025. The exploitation is known to be difficult. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

The vulnerability scanner Nessus provides a plugin with the ID 240097 (Ubuntu 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : Python vulnerabilities (USN-7570-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 3.14.0b1 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (240097), EUVD (EUVD-2025-15156) and CERT Bund (WID-SEC-2025-1850). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Affected

• Xerox FreeFlow Print Server

Productinfo

Type

• Programming Language Software

Name

• CPython

Version

• 2.7
• 2.7.9
• 2.7.10
• 2.7.12
• 2.7.13
• 3.3.2
• 3.3.3
• 3.4.3
• 3.4.4
• 3.4.5
• 3.5.1
• 3.5.2
• 3.6.0
• 3.6.1
• 3.6.2
• 3.6.3
• 3.6.4
• 3.6.5
• 3.6.6
• 3.6.7
• 3.6.8
• 3.6.9
• 3.6.10
• 3.6.13
• 3.7
• 3.7.0
• 3.7.1
• 3.7.2
• 3.7.3
• 3.7.4
• 3.7.5
• 3.7.6
• 3.7.9
• 3.7.10
• 3.8.0
• 3.8.1
• 3.8.7
• 3.8.8
• 3.9
• 3.9.1
• 3.9.2
• 3.9.18
• 3.10.0
• 3.10.13
• 3.10.14
• 3.11.4
• 3.11.8
• 3.11.9
• 3.12.0 Alpha 7
• 3.12.0b0
• 3.12.0b1
• 3.12.1
• 3.12.2
• 3.12.3
• 3.12.4
• 3.13.0a1
• 3.13.0a2
• 3.13.0a3
• 3.13.0a4
• 3.13.0a5
• 3.13.0a6
• 3.13.0b1
• 3.13.0rc2
• 3.14.0
• 3.14.0a1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion