Default mimetype known files writeable on Windows
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- Present
- Impact type
- Code execution
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-426.
Summary
There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”). To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Python Software Foundation | CPython | before 3.11.18; 3.12.0 to before 3.12.16; 3.13.0 to before 3.13.18; 3.14.0 to before 3.14.9; 3.15.0 to before 3.15.1; 3.16.0a1 to before 3.16.0 | 3.11.18, 3.12.16, 3.13.18, 3.14.9, 3.15.1, 3.16.0 | Patch available | CNA |
- CPython VendorPython Software Foundation Affected before 3.11.18; 3.12.0 to before 3.12.16; 3.13.0 to before 3.13.18; 3.14.0 to before 3.14.9; 3.15.0 to before 3.15.1; 3.16.0a1 to before 3.16.0 Fixed in 3.11.18, 3.12.16, 3.13.18, 3.14.9, 3.15.1, 3.16.0 Patch available CNA
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | — | — | python-pillow |
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions — — ·python-pillow
Remediation
- Fix · CNA CPython (Python Software Foundation) Fixed in 3.11.18, 3.12.16, 3.13.18, 3.14.9, 3.15.1, 3.16.0
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
Not affected: 6 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Enterprise Linux AI (RHEL AI)
Timeline
- 2026-10-02 Threatist record created from CVE-2024-3220
- 2026-10-03 Alias added: GHSA-74p9-4v44-wwx5
- 2026-10-15 Fix available: Python Software Foundation/[email protected] · CNA
- 2026-10-15 1 new reference · CNA
- 2026-10-16 1 new reference · CNA
- 2026-10-18 2 new references · CNA
- 2026-10-22 Fix available: Python Software Foundation/[email protected], Python Software Foundation/[email protected] · CNA
- 2026-10-26 EPSS moved to the 50th–90th percentile
- 2026-10-26 Fix available: Python Software Foundation/[email protected], Python Software Foundation/[email protected], Python Software Foundation/[email protected] · CNA
- 2026-10-26 3 new references · CNA
References
Patch 6
- https://github.com/python/cpython/commit/04a29bf8f9ff8526cd96cb7368400173303a390a
- https://github.com/python/cpython/commit/5550519259656cbb8eeac09e3dbc0d5c248a4dea
- https://github.com/python/cpython/commit/76f4555c4ff10f5dda58d6528c17787df41e256c
- https://github.com/python/cpython/commit/2f00690fd5a75305e02c99628a41439179266f29
- https://github.com/python/cpython/commit/35dd324f6e30735162a68cde84bb04a169004325
- https://github.com/python/cpython/commit/8d4286a3f41d36f42c4b4cf5c4451a5a8c23fe87
Advisory 1
More Python Software Foundation vulnerabilities
- TI-2024-07037 Quadratic complexity parsing cookies with backslashes CVSS 3.1HIGH 7.5
- TI-2024-11791 Bypass extraction filter to modify file metadata outside extraction directory CVSS 3.1MEDIUM 5.3
- TI-2024-00411 Quoted zip-bomb protection for zipfile CVSS 3.1MEDIUM 6.2
- TI-2026-13296 `HTTPPasswordMgr` can send saved HTTPS credentials via HTTP because of incorrect scheme matching CVSS 4.0MEDIUM 6.0
- TI-2024-06422 Email header injection due to unquoted newlines CVSS 3.1MEDIUM 5.5
- TI-2026-04606 Possible to hijack modules in current working directory CVSS 4.0MEDIUM 5.6
Sources
- CVE-2024-3220 · CVE Program
- CVE-2024-3220 · NVD
- FIRST EPSS
- GHSA-74p9-4v44-wwx5 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-3220 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences