CVE-2025-4516None▾ Sunlit

There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`

There is an issue in CPython when using `bytes.decode("unicode_escape", error="ignore|replace")`. If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop u…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

May 15, 2025

Updated

Jul 30, 2026

CVSS

—

Vendor

—

Product

—

CWE

CWE-416

Depth score

3 · Minimal

EPSS

0.22% · p12

Platforms

—

Source

NVD

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Jul 31.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 462 days

May 15, 2025Published
Disclosed via NVD
Jul 30, 2026Record revised
Last analysed / modified upstream
Jul 31, 2026EPSS first tracked
0.2%
Aug 20, 2026EPSS peak
0.2% → 0.2%

CWE-416 #nvd

Full technical detail▾

Overview

There is an issue in CPython when using bytes.decode("unicode_escape", error="ignore|replace"). If you are not using the "unicode_escape" encoding or an error handler your usage is not affected. To work-around this issue you may stop using the error= handler and instead wrap the bytes.decode() call in a try-except catching the DecodeError.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd