CVE-2026-44722 Details

A vulnerability in pyzipper, a Python library for handling AES-encrypted ZIP files, affects versions prior to 0.4.0. Due to a Python operator precedence error, the library's AES-2 encryption format was not automatically selected, leading to encrypted entries being written in the less secure AES-1 format. This oversight allowed the plaintext CRC32 checksum to be exposed in the ZIP header, and for unseekable archives, in the datadescripter section. An attacker with access to the archive could exploit this by brute-forcing candidate plaintexts for small or low-entropy files, using the CRC32 values as a comparison. The vulnerability has been addressed in version 0.4.0, which defaults to the AES-2 format and omits the CRC32 values, unless specified otherwise.

Upgrade to pyzipper version 0.4.0 or later, which automatically uses the AES-2 format and excludes CRC32 values for small files. If the vulnerability has been exploited, rewrite the ZIP archive to remove the CRC32 values and avoid leaving the original local file header in a detached state.