CVE-2025-13327mediumCWE-1286

CVE-2025-13327: medium-severity vulnerability in astral-sh uv

Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials

Published · Updated

Follow this CVE+ Monitor Red Hat OpenShift AI+ Monitor Red Hat AI Inference Server

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.3epss 0.2%
A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring user interaction to install an attacker-controlled package.
CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
astral-sh · uvRed Hat · Red Hat AI Inference ServerRed Hat · Red Hat OpenShift AI 3.0Red Hat · Red Hat OpenShift AI (RHOAI)
Related CVEs — astral-sh uv

In the same product, most dangerous first.

CVE-2023-52355HIGHLibtiff: tiffrasterscanlinesize64 produce too-big size and could cause oomEPSS 1.8%CVE-2026-56211HIGHLibaom: libaom: remote code execution via svc layer context handling with attacker-controlled framesEPSS 0.9%CVE-2026-58015MEDIUMGlib: path traversal in glib/gio/gdbusauthmechanismsha1.c via keyring_lookup_entry and mechanism_client_data_receiveEPSS 0.8%CVE-2026-14164HIGHLibarchive: double-free vulnerability in rar5 decompression logic via dangling filtered_buf pointer in init_unpack()EPSS 0.8%CVE-2026-74860HIGHLibxml2: double-free/uaf in libxml2 python bindingsEPSS 0.7%CVE-2026-56209HIGHLibaom: libaom: arbitrary address write via svc layer context oob and cyclic refresh map pointer hijackEPSS 0.6%