The vulnerability in CPython arises because the import hook that manages legacy .pyc files (SourcelessFileLoader) is incorrectly implemented in its base class FileLoader. Specifically, FileLoader does not utilize io.open_code() when reading .pyc files, which results in sys.audit events for this operation not being triggered. This flaw affects the auditing mechanism rather than the core loading functionality itself.

The impact is limited to the failure of sys.audit handlers to fire during the reading of legacy .pyc files. This could reduce the effectiveness of auditing and monitoring systems relying on these events to detect or log import activities. There is no indication of direct code execution or privilege escalation from this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided at this time. Users should monitor Python Software Foundation advisories for updates and consider additional auditing or monitoring controls to compensate for this gap until a fix is available.