PT-2026-49724
CVE-2026-12003
·
Published
2026-06-16
·
Updated
2026-09-23
Description by
CVSS 4.0
6.3
MediumMetricsAV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Name of the Vulnerable Software and Affected Versions
Python (affected versions not specified)
Description
On Windows, Python uses the
VPATH variable to locate landmarks, such as 'Modules/setup.local', to determine if it is running in a source tree and adjust the default sys.path. In certain configurations, specifically with the legacy EXE installer, the VPATH value '....' results in a landmark path outside the installation directory. Because Windows may allow low-privilege users to create folders in the root directory of the OS drive, an attacker could create the landmark and an alternative Lib folder. This allows the restricted installation to discover and load unauthorized files, potentially leading to a privilege escalation.Recommendations
Migrate from the legacy installer to the Python install manager to perform a per-user installation.
Preemptively create and restrict access to a
Modules directory.Exploitability
Exploit
Fix
Impacts
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾