CVE-2026-12003 — Python Software Foundation CPython

What is CVE-2026-12003?

To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python assumes it is running in a source tree and generates a different default sys.path. This code remains in release builds, so that release-ready builds can be built in-tree. On Windows, since builds are written to 'PCbuild/', the value of VPATH is set to '..\..', which results in a landmark of '..\..\Modules\setup.local'. This path is outside the install directory of Python, and may have different permissions, potentially allowing a low-privilege user to create the landmark and an alternative `Lib` folder that will be discovered by an otherwise restricted install. Such a setup occurs with the legacy default install location for all users (in the now superseded EXE installer), due to how Windows allows all users to create folders in the root directory of their OS drive. Our recommended mitigation on Windows is to migrate away from the legacy installer and use the new [Python install manager](https://www.python.org/downloads/latest/pymanager/) to install for the current user. Installs where the directory two levels above the Python installation directory have equivalent permissions are unaffected (in general, a per-user install cannot be modified at all by other users, removing any escalation of privilege risk, and could be directly modified by a privileged user, making the potential tampering irrelevant). Alternative mitigations might include preemptively creating and restricting access to a `Modules` directory. Be aware that only 3.13 and 3.14 will receive updated legacy installers - earlier fixes are only provided as sources. Platforms other than Windows allow VPATH to be overridden, but as they don't usually use a separated directory in the build for binaries, are unlikely to have a landmark reference outside of the install directory. The landmark detection involving VPATH is a fallback for when a more specific landmark - .\pybuilddir.txt - is absent, and was included for compatibility. Future releases of Python will no longer include the fallback, and so builds will need to generate or preserve the pybuilddir.txt file in order to work in-tree. This landmark file has been generated on Windows since 3.11, and on other platforms for longer.

The record classifies CVE-2026-12003 under weakness class CWE-427. 1 affected-product entry is recorded, across 1 vendor, listed below. The identifier was first published 116 days ago.

Severity and exploitation probability

CVSS v4.0 base score: 5.3 — Medium (derived from score)
CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
EPSS (FIRST): 0.1% probability of exploitation in the next 30 days, higher than 3.4% of all scored CVEs
CISA KEV: Not listed in the CISA Known Exploited Vulnerabilities catalog
Threadlinqs priority: 2.8/10 — a Threadlinqs composite of the CVSS base score, the EPSS percentile and public exploit availability
Published: 2026-06-16, last modified 2026-08-13

Is CVE-2026-12003 being exploited?

It currently carries a trending score of 7 in the Threadlinqs vulnerability feed.

Affected products and versions

Python Software Foundation: CPython

How to fix CVE-2026-12003

No vendor patch reference has been recorded for CVE-2026-12003 in the tracked sources. Follow the references below for a fix, and treat the products listed above as exposed until the vendor states otherwise.

Threat activity tracking CVE-2026-12003

1 tracked threat in the Threadlinqs corpus references CVE-2026-12003, either in the campaign’s CVE list or as an indicator on the campaign record.

CVE-2026-12003: CPython on Windows VPATH uncontrolled search path (CWE-427) enables cross-account code execution and privilege escalation — MEDIUM · 2026-08-05

Sources

Enriched from CVE.org, FIRST EPSS. Last verified by Threadlinqs on 2026-10-10.

Vendor advisory and patch

Issue tracking and product pages

github.com — issue tracking

Showing 6 of 9 recorded references.