CVE-2025-13837

Out-of-memory when loading Plist

State: Published
Severity: 2.1 Low
Published: Dec 1, 2025
Updated: Mar 3, 2026
Reserved: Dec 1, 2025

Description

When loading a plist file, the plistlib module reads data in size specified by the file itself, meaning a malicious file can cause OOM and DoS issues

Scores

CVSS	Score	Vector	Source
4.0	2.1 Low	CVSS:4.0/AV:L/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:L/SA:N	PSF

Weaknesses

CWE-400 Uncontrolled Resource Consumption

Affected Products

Product	Versions
CPythonPython Software Foundation	before 3.10.20Affected 3.11.0 to before 3.11.15Affected 3.12.0 to before 3.12.13Affected 3.13.0 to before 3.13.10Affected 3.14.0 to before 3.14.1Affected 3.15.0a1 to before 3.15.0a3Affected

References

https://github.com/python/cpython/pull/119343patch
https://github.com/python/cpython/issues/119342issue-tracking
https://github.com/python/cpython/commit/694922cf40aa3a28f898b5f5ee08b71b4922df70patch
https://github.com/python/cpython/commit/71fa8eb8233b37f16c88b6e3e583b461b205d1bapatch
https://github.com/python/cpython/commit/b64441e4852383645af5b435411a6f849dd1b4cbpatch
https://mail.python.org/archives/list/security-announce@python.org/thread/2X5IBCJXRQAZ5PSERLHMSJFBHFR3QM2C/vendor-advisory
https://github.com/python/cpython/commit/5a8b19677d818fb41ee55f310233772e15aa1a2bpatch
https://github.com/python/cpython/commit/568342cfc8f002d9a15f30238f26b9d2e0e79036patch
https://github.com/python/cpython/commit/cefee7d118a26ef6cd43db59bb9d98ca9a331111patch

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.