pyzipper CVE-2026-44722

The vulnerability requires the attacker to possess or access the encrypted ZIP archive itself; remote network exploitation is not possible. The archive must contain files encrypted with pyzipper versions prior to 0.4.0 using AES encryption (AE-1 format). Exploitation is practical only against files with small or low-entropy plaintext content (approximately under 20 bytes uncompressed or with predictable/limited value space such as passwords, PINs, or short tokens). Files with large or high-entropy content (images, PDFs, random data, or files >20 bytes of random material) are not practically at risk under current computational constraints. Unseekable ZIP archives exhibit additional behavior where CRC32 values are written to data descriptors, but this does not mitigate the underlying vulnerability for seekable archives. No authentication, special configuration, or user interaction is required once the archive is obtained.

CVSS 6.2 (AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) indicates local attack vector with high confidentiality impact but no integrity or availability impact. However, this CVSS vector does not align with the actual vulnerability mechanics: the attack requires an attacker to possess the encrypted archive (implying prior access or theft) but does not require local code execution on the victim's system-the CRC32 brute-force can be performed entirely offline on attacker-controlled infrastructure. The true risk is highly granular: files below ~20 bytes or with low entropy (passwords, small integers, predictable data) face practical cryptanalysis; large or high-entropy files remain computationally safe. No active exploitation, POC, or KEV status has been identified. The vulnerability is a cryptographic weakness rather than a remote code execution or system compromise vector. Organizations should prioritize re-encryption of sensitive small files or low-entropy content archived with vulnerable versions; bulk encrypted archives of large files pose minimal real-world risk unless they contain multiple small-file targets. Missing data: no EPSS score provided; exploit automation feasibility and prevalence are unknowns.

An attacker obtains an encrypted ZIP file created with vulnerable pyzipper (e.g., via email interception, cloud storage breach, or insider access). The attacker extracts the plaintext CRC32 checksum from the ZIP local file header without decryption. If the archive contains small files (e.g., a 4-byte PIN or 8-byte token), the attacker generates candidate plaintexts, computes CRC32 for each, and compares against the stored value to identify the correct plaintext in seconds to minutes. Large files or high-entropy data (e.g., a 1 MB image or random key) would require exhaustive search across trillions of CRC32 matches, making the attack infeasible.