EUVD-2025-208130Published
Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials
Related advisories and sources
Publishers link these advisories through the identifiers shown below. A shared identifier or date alone does not tell you whether your software is affected or whether the advisories describe the same cause.
CVE-2025-13327 · CVE overview and exploitation status
cve-program · CVE-2025-13327
- https://access.redhat.com/errata/RHSA-2026:91219
- https://access.redhat.com/errata/RHSA-2026:91232
- https://access.redhat.com/errata/RHSA-2026:91236
- https://access.redhat.com/errata/RHSA-2026:94459
- https://access.redhat.com/errata/RHSA-2026:94476
- https://access.redhat.com/errata/RHSA-2026:96400
- https://access.redhat.com/errata/RHSA-2026:96403
- https://access.redhat.com/errata/RHSA-2026:96406
- https://access.redhat.com/security/cve/CVE-2025-13327
- https://bugzilla.redhat.com/show_bug.cgi?id=2407263
- https://github.com/astral-sh/uv
- https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628
- https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64
euvd · EUVD-2025-208130
- https://access.redhat.com/errata/RHSA-2026:91219
- https://access.redhat.com/errata/RHSA-2026:91232
- https://access.redhat.com/errata/RHSA-2026:91236
- https://access.redhat.com/errata/RHSA-2026:94459
- https://access.redhat.com/errata/RHSA-2026:94476
- https://access.redhat.com/errata/RHSA-2026:96400
- https://access.redhat.com/errata/RHSA-2026:96403
- https://access.redhat.com/errata/RHSA-2026:96406
- https://access.redhat.com/security/cve/CVE-2025-13327
- https://bugzilla.redhat.com/show_bug.cgi?id=2407263
- https://github.com/astral-sh/uv
- https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628
- https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64
nvd · CVE-2025-13327
- https://access.redhat.com/errata/RHSA-2026:91219
- https://access.redhat.com/errata/RHSA-2026:91232
- https://access.redhat.com/errata/RHSA-2026:91236
- https://access.redhat.com/errata/RHSA-2026:94459
- https://access.redhat.com/errata/RHSA-2026:94476
- https://access.redhat.com/errata/RHSA-2026:96400
- https://access.redhat.com/errata/RHSA-2026:96403
- https://access.redhat.com/errata/RHSA-2026:96406
- https://access.redhat.com/security/cve/CVE-2025-13327
- https://bugzilla.redhat.com/show_bug.cgi?id=2407263
- https://github.com/astral-sh/uv
- https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628
- https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64
osv · GHSA-v653-r55g-hcmg
- https://github.com/astral-sh/uv/security/advisories/GHSA-pqhf-p39g-3x64
- https://nvd.nist.gov/vuln/detail/CVE-2025-13327
- https://github.com/astral-sh/uv/commit/da659fee4898a73dbc75070f3e82d49f745e4628
- https://access.redhat.com/errata/RHSA-2026:91219
- https://access.redhat.com/errata/RHSA-2026:91232
- https://access.redhat.com/errata/RHSA-2026:91236
- https://access.redhat.com/errata/RHSA-2026:94459
- https://access.redhat.com/errata/RHSA-2026:94476
- https://access.redhat.com/errata/RHSA-2026:96400
- https://access.redhat.com/errata/RHSA-2026:96403
- https://access.redhat.com/errata/RHSA-2026:96406
- https://access.redhat.com/security/cve/CVE-2025-13327
- https://bugzilla.redhat.com/show_bug.cgi?id=2407263
- https://github.com/astral-sh/uv
Related changes
Linked by CVE identifier- A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 15 Nov 2026
- A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 14 Nov 2026
- Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials · Affected-version evidence changed · 13 Nov 2026
- uv has ZIP payload obfuscation through parsing differentials · Advisory content revised · 13 Nov 2026
- A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 7 Nov 2026
- A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 6 Nov 2026
- A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 5 Nov 2026
- Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials · Affected-version evidence changed · 4 Nov 2026
- A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 4 Nov 2026
- uv has ZIP payload obfuscation through parsing differentials · Advisory content revised · 4 Nov 2026
- Uv: uv: specially crafted zip archives lead to arbitrary code execution due to parsing differentials · Affected-version evidence changed · 3 Nov 2026
- uv has ZIP payload obfuscation through parsing differentials · Advisory content revised · 3 Nov 2026
- A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 31 Oct 2026
- A flaw was found in uv. This vulnerability allows an attacker to execute malicious code during package resolution or installation via specially crafted ZIP (Zipped Information Package) archives that exploit parsing differentials, requiring … · Advisory content revised · 31 Oct 2026