The vulnerability in CPython concerns the handling of legacy .pyc files by the import hook mechanism. Specifically, the FileLoader base class incorrectly processes these files by not utilizing io.open_code() for reading, which prevents sys.audit handlers from firing during this import event. This issue impacts CPython versions including 0, 3.14.0, and 3.15.0a1. The CVSS 4.0 score is 5.7 (medium severity), indicating a local attack vector with low complexity, requiring partial privileges, no user interaction, and resulting in high impact on integrity but no impact on confidentiality or availability.

The vulnerability causes sys.audit handlers not to trigger when legacy .pyc files are imported, potentially reducing the effectiveness of auditing and monitoring mechanisms that rely on these handlers. There is no direct impact on confidentiality or availability, but integrity could be affected if malicious .pyc files are loaded without proper audit logging. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch links or official fixes are provided, users should monitor Python Software Foundation advisories for updates. Until a fix is available, consider additional monitoring or controls around the use of legacy .pyc files and audit configurations.