CVE-2026-0864 is a vulnerability in the CPython configparser module where writing configuration files with multi-line text values containing carriage return characters (\r) can lead to injection of unexpected keys and values. This happens if an attacker controls the value being written, potentially manipulating the configuration file structure. The vulnerability affects CPython versions before 3.15.0. No official patch or remediation level has been stated in the available data.

An attacker with the ability to control values written by the configparser module could inject unexpected keys and values into configuration files. This could lead to configuration manipulation or unexpected behavior in applications relying on these config files. The CVSS score of 4.1 indicates a medium severity impact, requiring some privileges and user interaction for exploitation.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, avoid writing untrusted multi-line text containing carriage return characters using the configparser module or sanitize inputs to prevent injection of control characters.