There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning… (CVE-2024-3220)

CVE-2024-3220 describes a vulnerability in the CPython standard library's mimetypes module on Windows platforms. The module uses default file locations for MIME type definitions that are writable by users on Windows, unlike on Linux or macOS. This writable state enables other users to create or modify files in these locations, potentially causing a MemoryError on Python startup or incorrect MIME type interpretation. The defect stems from reusing Linux/macOS default paths on Windows where the directories are user-writable. A workaround is to call mimetypes.init() with an empty list on Windows to avoid using these default locations.

The vulnerability may cause Python runtime startup to raise a MemoryError or result in incorrect file type interpretation due to manipulated MIME type files. This can affect applications relying on the mimetypes module for file type detection. There is no indication of remote code execution or privilege escalation. The impact is limited to denial of service or incorrect behavior in MIME type handling.

No official patch or fix is currently documented. As a workaround, users on Windows can call mimetypes.init() with an empty list ([]) to prevent the module from using the default writable file locations. This avoids the vulnerability by not loading MIME type definitions from user-writable paths. Monitor official CPython advisories for any future patches.