Executive brief
A vulnerability in the Windows version of Python could allow a low-privileged user to trick the software into loading malicious code. This occurs because Python looks for certain configuration files in locations outside its secure installation folder, which may be accessible to other users on the same computer. If exploited, an attacker could gain the same permissions as the person running Python, potentially leading to unauthorized data access or system changes.
Technical details
Python for Windows uses a build-time variable (VPATH) to locate 'landmark' files like 'Modules/setup.local' to support in-tree builds. On Windows, VPATH is often set to '..\..', causing Python to look for these landmarks two levels above the executable. In legacy 'all users' installations (e.g., C:\Python3x), this path resolves to the drive root (C:\), where Windows often allows standard users to create folders. An attacker can create a 'Modules' directory and a malicious 'Lib' folder at this location; when Python starts, it identifies the landmark, assumes an in-tree layout, and prepends the attacker's 'Lib' folder to sys.path, leading to arbitrary code execution. The fix involves removing the VPATH fallback in getpath.py.
Affected products
- Python Software Foundation Python 3.11, 3.12, 3.13, 3.14, 3.15, 3.16
Timeline
- 2026-06-16: disclosed: Reported by Jake Yamaki of Bishop Fox
- 2026-06-16: advisory
- 2026-06-16: patched: Pull request 151545 opened to remove the fallback mechanism