Low severity · published Feb 14, 2025
CVE-2024-3220
Default mimetype known files writeable on Windows
2.3
CVSS
0.7%
EPSS
No
On KEV
Description
There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type.
This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”).
To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.7% · higher than 54% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CP
CPython · Python Software Foundation
before 3.11.18; 3.12.0 before 3.12.16; 3.13.0 before 3.13.18; 3.14.0 before 3.14.9; 3.15.0 before 3.15.1; 3.16.0a1 before 3.16.0 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-3220
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-3220
github.com
https://github.com/python/cpython/commit/04a29bf8f9ff8526cd96cb7368400173303a390a
github.com
https://github.com/python/cpython/commit/2f00690fd5a75305e02c99628a41439179266f29
github.com
https://github.com/python/cpython/commit/35dd324f6e30735162a68cde84bb04a169004325
github.com
https://github.com/python/cpython/commit/5550519259656cbb8eeac09e3dbc0d5c248a4dea
github.com
https://github.com/python/cpython/commit/76f4555c4ff10f5dda58d6528c17787df41e256c
github.com
https://github.com/python/cpython/commit/8d4286a3f41d36f42c4b4cf5c4451a5a8c23fe87
More from CPython
9.4
CVE-2026-115557
Distrust compromised intermediate certificates in ssl module
9.2
CVE-2026-19445
Use-after-free of a server-side SSLContext when sni_callback switches contexts
8.8
CVE-2026-3298
Out-of-bounds write in Windows asyncio.ProacterEventLoop.sock_recvfrom_into() when using nbytes
8.4
CVE-2026-82049
tarfile extraction filters allow file modification and content disclosure via hard link to symlink
8.2
CVE-2026-11972
tarfile opened in streaming mode mishandles EOF
