# CVE-2023-49797: Local Privilege Escalation in Windows

Source: https://junglewise.ai/threats/cve-2023-49797-local-privilege-escalation-in-windows  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2023-12-09  
License: CC BY 4.0 with a link back

CVE-2023-49797 · Severity: low · CVSS 3.1 · Published 2023-12-09

PyInstaller bundles a Python application and all its dependencies into a single package. A PyInstaller built application, elevated as a privileged process, may be tricked by an unprivileged attacker into deleting files the unprivileged user does not otherwise have access to. A user is affected if **all** the following are satisfied: 1. The user runs an application containing either `matplotlib` or `win32com`. 2. The application is ran as administrator (or at least a user with higher privileges than the attacker). 3. The user's temporary directory is not locked to that specific user (most likely due to `TMP`/`TEMP` environment variables pointing to an unprotected, arbitrary, non default location). Either: A. The attacker is able to very carefully time the replacement of a temporary file with a symlink. This switch must occur exactly between `shutil.rmtree()`'s builtin symlink check and the deletion itself B: The application was built with Python 3.7.x or earlier which has no protection against Directory Junctions links. The vulnerability has been addressed in PR #7827 which corresponds to `pyinstaller >= 5.13.1`. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Technologies: [pyinstaller (PyPI)](https://junglewise.ai/threats/technologies/pyinstaller). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2023-49797 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2023-49797 being exploited in the wild.

**How severe is CVE-2023-49797?** Low severity, with a CVSS score of 3.1, published 9 December 2023.

**Which products and versions are affected?** pyinstaller (PyPI) ECOSYSTEM:introduced=0,fixed=5.13.1.

**Is there a fix for CVE-2023-49797?** Yes. pyinstaller (PyPI): upgrade to 5.13.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2023-49797?** Check whether you run pyinstaller (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- pyinstaller (PyPI): upgrade to 5.13.1 or later

  ```sh
  pip install "pyinstaller>=5.13.1"
  ```


## Affected products

- pyinstaller (PyPI) ECOSYSTEM:introduced=0,fixed=5.13.1

## Identifiers

- CVE-2023-49797
- GHSA-9w2p-rh8c-v9g5
- PYSEC-2023-292

## Related threats

- [PYSEC-2026-1813 - PyInstaller has local privilege escalation vulnerability](https://junglewise.ai/threats/cve-2025-59042-pyinstaller-has-local-privilege-escalation-vulnerability)
- [PYSEC-2020-194 - In PyInstaller before version 3.6, only on Windows, a local privilege escalation vulnerability is…](https://junglewise.ai/threats/pysec-2020-194-in-pyinstaller-before-version-3-6-only-on-windows-a-2e4087da)
- [Local Privilege Escalation in PyInstaller](https://junglewise.ai/threats/cve-2019-16784-local-privilege-escalation-in-pyinstaller)