# CVE-2026-12003: Python uncontrolled search path in Windows VPATH landmark detection

Source: https://junglewise.ai/threats/cve-2026-12003-python-uncontrolled-search-path-in-windows-vpath-landmark  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-16. Updated: 2026-06-16  
License: CC BY 4.0 with a link back

CVE-2026-12003 · Severity: info · CVSS 5.3 · Published 2026-06-16

A vulnerability in the Windows version of Python could allow a low-privileged user to trick the software into loading malicious code. This occurs because Python looks for certain configuration files in locations outside its secure installation folder, which may be accessible to other users on the same computer. If exploited, an attacker could gain the same permissions as the person running Python, potentially leading to unauthorized data access or system changes.

## Quick answers

**Is CVE-2026-12003 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-12003 being exploited in the wild.

**How severe is CVE-2026-12003?** Informational severity, with a CVSS score of 5.3, published 16 June 2026.

**Which products and versions are affected?** Python Software Foundation Python 3.11, 3.12, 3.13, 3.14, 3.15, 3.16.

**Is there a fix for CVE-2026-12003?** A patch was published on 2026-06-16: Pull request 151545 opened to remove the fallback mechanism Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-12003 attacked?** It is attacked with local access, in a software library.

**Am I affected by CVE-2026-12003?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

Python for Windows uses a build-time variable (VPATH) to locate 'landmark' files like 'Modules/setup.local' to support in-tree builds. On Windows, VPATH is often set to '..\..', causing Python to look for these landmarks two levels above the executable. In legacy 'all users' installations (e.g., C:\Python3x), this path resolves to the drive root (C:\), where Windows often allows standard users to create folders. An attacker can create a 'Modules' directory and a malicious 'Lib' folder at this location; when Python starts, it identifies the landmark, assumes an in-tree layout, and prepends the attacker's 'Lib' folder to sys.path, leading to arbitrary code execution. The fix involves removing the VPATH fallback in getpath.py.

## Affected products

- Python Software Foundation Python 3.11, 3.12, 3.13, 3.14, 3.15, 3.16

## Timeline

- 2026-06-16: disclosed: Reported by Jake Yamaki of Bishop Fox
- 2026-06-16: advisory
- 2026-06-16: patched: Pull request 151545 opened to remove the fallback mechanism

## References

- [https://github.com/python/cpython/issues/151544](https://github.com/python/cpython/issues/151544)
- [https://github.com/python/cpython/pull/151545](https://github.com/python/cpython/pull/151545)
- [https://https//mail.python.org/archives/list/security-announce@python.org/thread/JIFOBO7UX3LY4VJKJUOKYJV62CFR2IRH/](https://https//mail.python.org/archives/list/security-announce@python.org/thread/JIFOBO7UX3LY4VJKJUOKYJV62CFR2IRH/)