CPython CVE-2026-12003

Exploitation requires all of the following specific, concurrent conditions: (1) CPython must be installed on Windows using the legacy EXE installer in all-users mode at the default path (e.g., C:\Python313\), placing the install such that the directory two levels above it is the OS drive root (C:\), which Windows grants all authenticated users CreateFolder permissions on by default; (2) pybuilddir.txt must be absent from the executable directory, activating the VPATH-based BUILD_LANDMARK fallback in Modules/getpath.py; (3) a low-privileged local account (PR:L per CVSS vector) must be able to create the directory C:\Modules\ and place Setup.local within it before a privileged user runs Python; (4) a user with higher privileges must actively invoke python.exe from the vulnerable install (UI:A per CVSS 4.0 vector). Exploitation is explicitly NOT possible against per-user installs, installs in paths where the grandparent directory has restricted permissions, any install where pybuilddir.txt is already present, or any non-Windows platform. These compounding conditions meaningfully limit realistic attacker opportunity beyond the raw CVSS impact scores.

The CVSS 4.0 base score of 5.3 accurately reflects the layered constraints: local access is required (AV:L), specific attack preconditions must be present (AT:P - legacy all-users EXE installer at default OS-root-adjacent path), only a low-privileged account is needed (PR:L), and active interaction by a higher-privileged user is required to trigger loading (UI:A). This is not a remotely triggerable flaw and is not listed in CISA KEV. No EPSS score was included in the provided intelligence, limiting probabilistic exploitation forecasting; however, the narrow preconditions - legacy installer, default path, specific Windows directory permission behavior - suggest limited widespread exposure. The high VC:H and VI:H impacts are realistic once conditions are met, since full module substitution grants code execution as the victim user. Real-world priority is moderate: environments still using the legacy all-users EXE installer at default locations represent the materially affected population. Per-user installs and new pymanager-based installs are unaffected. No conflicting signals exist between the CVSS vector and the description.

A low-privileged user on a Windows system where Python 3.13 is installed for all users via the legacy EXE installer at C:\Python313\ creates the directory C:\Modules\ and places a crafted Setup.local file there, then populates C:\Lib\ with trojanized Python standard library modules. When an administrator or privileged service account subsequently invokes python.exe from that installation - for example, running a scheduled maintenance script - CPython's VPATH-based fallback landmark detection triggers (because pybuilddir.txt is absent), causing the interpreter to discover and load from the attacker-controlled C:\Lib\ directory, executing arbitrary code under the victim's elevated privileges. No public exploit code has been identified at time of analysis.