Description
There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type.
This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”).
To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Python Software Foundation | CPython | < 3.11.18, 3.12.0 – < 3.12.16, 3.13.0 – < 3.13.18, 3.14.0 – < 3.14.9, 3.15.0 – < 3.15.1, 3.16.0a1 – < 3.16.0 | 3.11.18 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.23 | python3 | 3.12.16-r0 | — |
| Alpine v3.22 | python3 | 3.12.16-r0 | — |
| Alpine v3.21 | python3 | 3.12.16-r0 | — |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | docbook5-style-xsl | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | python-3.14 | 3.14.2-r3 | — |
Advisories 1
- WID-SEC-2025-0379 Python: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Jul 9, 2026
References
- https://mail.python.org/archives/list/security-announce@python.org/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R/ vendor-advisory
- https://github.com/python/cpython/issues/159428 issue-tracking
- https://github.com/python/cpython/commit/04a29bf8f9ff8526cd96cb7368400173303a390a patch
- https://github.com/python/cpython/commit/5550519259656cbb8eeac09e3dbc0d5c248a4dea patch
- https://github.com/python/cpython/commit/76f4555c4ff10f5dda58d6528c17787df41e256c patch
- https://github.com/python/cpython/commit/2f00690fd5a75305e02c99628a41439179266f29 patch
- https://github.com/python/cpython/commit/35dd324f6e30735162a68cde84bb04a169004325 patch
- https://github.com/python/cpython/commit/8d4286a3f41d36f42c4b4cf5c4451a5a8c23fe87 patch