CVE-2026-12003: CWE-427 in Python Software Foundation CPython
To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python assumes it is running in a source tree and generates a different default sys.path. This code remains in release builds, so that release-ready builds can be built in-tree. On Windows, since builds are written to 'PCbuild/', the value of VPATH is set to '..\..', which results in a landmark of '..\..\Modules\setup.local'. This path is outside the install directory of Python, and may have different permissions, potentially allowing a low-privilege user to create the landmark and an alternative `Lib` folder that will be discovered by an otherwise restricted install. Such a setup occurs with the legacy default install location for all users (in the now superseded EXE installer), due to how Windows allows all users to create folders in the root directory of their OS drive. Our recommended mitigation on Windows is to migrate away from the legacy installer and use the new [Python install manager](https://www.python.org/downloads/latest/pymanager/) to install for the current user. Installs where the directory two levels above the Python installation directory have equivalent permissions are unaffected (in general, a per-user install cannot be modified at all by other users, removing any escalation of privilege risk, and could be directly modified by a privileged user, making the potential tampering irrelevant). Alternative mitigations might include preemptively creating and restricting access to a `Modules` directory. Be aware that only 3.13 and 3.14 will receive updated legacy installers - earlier fixes are only provided as sources. Platforms other than Windows allow VPATH to be overridden, but as they don't usually use a separated directory in the build for binaries, are unlikely to have a landmark reference outside of the install directory. The landmark detection involving VPATH is a fallback for when a more specific landmark - .\pybuilddir.txt - is absent, and was included for compatibility. Future releases of Python will no longer include the fallback, and so builds will need to generate or preserve the pybuilddir.txt file in order to work in-tree. This landmark file has been generated on Windows since 3.11, and on other platforms for longer.
AI Analysis
Technical Summary
CPython uses the VPATH variable at build time to locate certain landmarks such as Modules/setup.local to determine if it is running in a source tree and adjust sys.path accordingly. On Windows, the legacy installer installs Python in a 'PCbuild/' directory with VPATH set to '..\\..', causing the landmark path '..\\..\\Modules\\setup.local' to be outside the install directory. Because Windows allows all users to create folders in the OS drive root, a low-privilege user could create this landmark and an alternative 'Lib' folder, which Python would trust, potentially leading to privilege escalation. This issue arises from the fallback landmark detection mechanism used when '.\pybuilddir.txt' is absent. Future Python releases will remove this fallback, requiring the presence of 'pybuilddir.txt' to work in-tree. The vulnerability affects CPython versions before 3.15.0.
Potential Impact
A low-privilege user on Windows systems using the legacy Python installer can create a landmark and an alternative library folder outside the Python install directory due to permissive directory permissions. This can cause Python to load code from an attacker-controlled location, potentially leading to privilege escalation or code execution with elevated privileges. The issue does not affect installations where the directory two levels above Python has equivalent permissions or per-user installs that restrict modification by other users.
Mitigation Recommendations
The vendor recommends migrating away from the legacy Python installer on Windows to the new Python install manager, which installs Python for the current user and avoids this issue. Alternatively, administrators can preemptively create and restrict access to the 'Modules' directory two levels above the Python install directory to prevent unauthorized creation of the landmark. Only Python versions 3.13 and 3.14 will receive updated legacy installers; earlier versions have fixes only in source form. Future Python releases will remove the fallback landmark detection, requiring the presence of 'pybuilddir.txt' to avoid this vulnerability. Patch status is not explicitly confirmed; check the vendor advisory for current remediation guidance.
CVE-2026-12003: CWE-427 in Python Software Foundation CPython
Description
To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python assumes it is running in a source tree and generates a different default sys.path. This code remains in release builds, so that release-ready builds can be built in-tree. On Windows, since builds are written to 'PCbuild/', the value of VPATH is set to '..\..', which results in a landmark of '..\..\Modules\setup.local'. This path is outside the install directory of Python, and may have different permissions, potentially allowing a low-privilege user to create the landmark and an alternative `Lib` folder that will be discovered by an otherwise restricted install. Such a setup occurs with the legacy default install location for all users (in the now superseded EXE installer), due to how Windows allows all users to create folders in the root directory of their OS drive. Our recommended mitigation on Windows is to migrate away from the legacy installer and use the new [Python install manager](https://www.python.org/downloads/latest/pymanager/) to install for the current user. Installs where the directory two levels above the Python installation directory have equivalent permissions are unaffected (in general, a per-user install cannot be modified at all by other users, removing any escalation of privilege risk, and could be directly modified by a privileged user, making the potential tampering irrelevant). Alternative mitigations might include preemptively creating and restricting access to a `Modules` directory. Be aware that only 3.13 and 3.14 will receive updated legacy installers - earlier fixes are only provided as sources. Platforms other than Windows allow VPATH to be overridden, but as they don't usually use a separated directory in the build for binaries, are unlikely to have a landmark reference outside of the install directory. The landmark detection involving VPATH is a fallback for when a more specific landmark - .\pybuilddir.txt - is absent, and was included for compatibility. Future releases of Python will no longer include the fallback, and so builds will need to generate or preserve the pybuilddir.txt file in order to work in-tree. This landmark file has been generated on Windows since 3.11, and on other platforms for longer.
CVSS v4.0
Score 5.3medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CPython uses the VPATH variable at build time to locate certain landmarks such as Modules/setup.local to determine if it is running in a source tree and adjust sys.path accordingly. On Windows, the legacy installer installs Python in a 'PCbuild/' directory with VPATH set to '..\\..', causing the landmark path '..\\..\\Modules\\setup.local' to be outside the install directory. Because Windows allows all users to create folders in the OS drive root, a low-privilege user could create this landmark and an alternative 'Lib' folder, which Python would trust, potentially leading to privilege escalation. This issue arises from the fallback landmark detection mechanism used when '.\pybuilddir.txt' is absent. Future Python releases will remove this fallback, requiring the presence of 'pybuilddir.txt' to work in-tree. The vulnerability affects CPython versions before 3.15.0.
Potential Impact
A low-privilege user on Windows systems using the legacy Python installer can create a landmark and an alternative library folder outside the Python install directory due to permissive directory permissions. This can cause Python to load code from an attacker-controlled location, potentially leading to privilege escalation or code execution with elevated privileges. The issue does not affect installations where the directory two levels above Python has equivalent permissions or per-user installs that restrict modification by other users.
Mitigation Recommendations
The vendor recommends migrating away from the legacy Python installer on Windows to the new Python install manager, which installs Python for the current user and avoids this issue. Alternatively, administrators can preemptively create and restrict access to the 'Modules' directory two levels above the Python install directory to prevent unauthorized creation of the landmark. Only Python versions 3.13 and 3.14 will receive updated legacy installers; earlier versions have fixes only in source form. Future Python releases will remove the fallback landmark detection, requiring the presence of 'pybuilddir.txt' to avoid this vulnerability. Patch status is not explicitly confirmed; check the vendor advisory for current remediation guidance.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- PSF
- Date Reserved
- 2026-06-11T17:05:37.519Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a3196620b89be688808a441
Added to database: 06/16/2026, 18:30:58 UTC
Last enriched: 07/06/2026, 23:31:18 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 121
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.