What is the CVSS score of CVE-2026-44722?

CVE-2026-44722 has a CVSS 3.1 base score of 6.2 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Is there a patch available for CVE-2026-44722?

Yes, a patch is available for CVE-2026-44722. Update the affected software to the latest version immediately.

pyzipper CVE-2026-44722

MEDIUM

Use of Incorrect Operator (CWE-480)

2026-05-14 https://github.com/danifus/pyzipper

GHSA-crqm-m339-7m2p

Python Information Disclosure

6.2

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.2 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Source Code Evidence Fetched

May 14, 2026 - 17:04 vuln.today

Analysis Generated

May 14, 2026 - 17:04 vuln.today

CVE Published

May 14, 2026 - 16:17 nvd

MEDIUM 6.2

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

75 pypi packages depend on pyzipper (66 direct, 9 indirect)

Ecosystem-wide dependent count for version 0.4.0.

DescriptionGitHub Advisory

Impact

A Python operator precedence bug in pyzipper/zipfile_aes.py caused the AE-2 format to never be automatically selected during encryption, regardless of file size or compression type. As a result, all encrypted entries are written in AE-1 format unless AE-2 is explicitly forced by the caller. AE-1 stores the plaintext CRC32 checksum unencrypted in the ZIP header. During investigation of this issue, it was also found that when writing to an unseekable zip archive, the CRC32 value was always written to the datadescripter section.

The AES encryption itself is not broken. An attacker who possesses the archive can read the CRC32 from the header without decrypting anything, then brute-force candidate plaintexts by computing CRC32(candidate) and comparing against the stored value. In practice, this attack is feasible today only against small or low-entropy files, as CRC32 exhaustion across a large plaintext space is computationally prohibitive on current hardware. Files with high-entropy or large content are not practically at risk under current computing constraints. Without this bug, pyzipper would have removed the CRC32 value for any file with content of less than 20 bytes uncompressed.

Patches

Upgrade to pyzipper 0.4.0 that changes the default behaviour of pyzipper to always use the AE-2 format and exclude the CRC32 values, unless instructed to do otherwise.

If rewriting the zip archive to remove the CRC values for small files, the entire zip archive should be recreated to avoid the original local file header with the CRC included remaining in the zip file in a detached state.

Credit

Thanks to Lucas Lavarello from Kulkan Security for identifying this issue.

References

https://www.winzip.com/en/support/aes-encryption/#CRC https://www.winzip.com/en/support/aes-encryption/#crc-faq

AnalysisAI

pyzipper before version 0.4.0 fails to use AE-2 encryption format due to an operator precedence bug, causing CRC32 checksums to be stored unencrypted in ZIP headers. Attackers with access to encrypted archives can extract plaintext CRC32 values and conduct brute-force attacks on small or low-entropy files to recover their content without decrypting the AES encryption itself. Large or high-entropy files remain practically safe under current computational constraints, but the vulnerability represents a cryptographic bypass for files under approximately 20 bytes.

Technical ContextAI

pyzipper is a Python library that extends the standard zipfile module to add AES encryption support for ZIP archives. The vulnerability stems from a Python operator precedence bug in pyzipper/zipfile_aes.py that prevents automatic selection of the AE-2 encryption format. AE-1 format stores plaintext CRC32 checksums in unencrypted ZIP local file headers, while AE-2 excludes these checksums entirely. The bug forces all encrypted entries into AE-1 format unless explicitly overridden. CRC32 is a 32-bit cyclic redundancy check with approximately 4.3 billion possible values-exhaustible through brute-force when plaintext space is small. The vulnerability affects the pkg:pip/pyzipper package on PyPI. The root cause is classified as CWE-480 (Use of Incorrect Operator).

RemediationAI

Upgrade pyzipper to version 0.4.0 or later, which changes the default encryption format to AE-2 and excludes CRC32 values from headers. For archives created with vulnerable versions containing sensitive small files or low-entropy content, re-encrypt the entire archive by extracting and re-zipping with the patched version 0.4.0 to ensure CRC32 values are removed from local file headers. Do not attempt in-place modification, as orphaned headers with CRC values may persist in the archive. Developers should audit application code to confirm pyzipper version and review any ZIP archives created with versions prior to 0.4.0 for exposure to small or low-entropy encrypted files. If immediate upgrade is not possible, explicitly force AE-2 format in pyzipper API calls until the library can be updated. For archived data at rest, prioritize re-encryption of archives containing short-form data (passwords, keys, metadata) over bulk archives of large files.