What’s Vulnerable › Vulnerabilities

CVE-2024-3220: Default mimetype known files writeable on Windows

• Severity: low (CVSS 2.3 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-02-14 · updated 2026-10-26
• Weakness: CWE-426

Description

There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type. This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”). To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.

Affected products

• Python: before 3.14.9; from 3.15.0 before 3.15.1; from 3.16.0a1 before 3.16.0 — fixed in 3.14.9, 3.15.1, 3.16.0

How to fix

Upgrade to a fixed version: Python 3.14.9, 3.15.1, 3.16.0. Check the vendor advisory for mitigations.

References

• https://github.com/python/cpython/commit/04a29bf8f9ff8526cd96cb7368400173303a390a
• https://github.com/python/cpython/commit/2f00690fd5a75305e02c99628a41439179266f29
• https://github.com/python/cpython/commit/35dd324f6e30735162a68cde84bb04a169004325
• https://github.com/python/cpython/commit/5550519259656cbb8eeac09e3dbc0d5c248a4dea
• https://github.com/python/cpython/commit/76f4555c4ff10f5dda58d6528c17787df41e256c
• https://github.com/python/cpython/commit/8d4286a3f41d36f42c4b4cf5c4451a5a8c23fe87
• https://github.com/python/cpython/issues/159428
• https://mail.python.org/archives/list/security-announce@python.org/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R/
• http://www.openwall.com/lists/oss-security/2025/02/14/8
• https://security.netapp.com/advisory/ntap-20250314-0001/

Get alerted when CVE-2024-3220 or the next vulnerability affects your stack