The vulnerability in CPython relates to the import hook mechanism for legacy .pyc files. Specifically, the FileLoader base class does not utilize io.open_code() when reading .pyc files, resulting in sys.audit events not firing as expected. This breaks the auditing chain for these file loads. Affected versions include CPython 0, 3.14.0, and 3.15.0a1. The CVSS 4.0 score is 5.7 (medium severity), with local attack vector, low complexity, partial privileges required, no user interaction, and high impact on integrity. No patch or vendor advisory is currently available, and no exploits are known.

The primary impact is that sys.audit handlers do not trigger when legacy .pyc files are loaded via the affected import hook. This reduces visibility into code loading events, potentially hindering detection of malicious or unauthorized code execution. There is no direct indication of code execution or privilege escalation from this vulnerability alone. The medium CVSS score reflects the limited but meaningful impact on auditing and integrity.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until an official fix is released, users should be aware that auditing of legacy .pyc file imports may be incomplete. No specific workaround or temporary fix is documented at this time.