CPython Windows VPATH Landmark Search Path Privilege Escalation

CVE-2026-12003 is a moderate-severity vulnerability in CPython affecting versions up to and including 3.11.15, 3.12.13, 3.13.14, 3.14.6, and 3.15.0b2. CPython retains logic in release builds to support running from an in-tree build layout rather than an installed layout. That logic uses the build-time VPATH variable to locate landmarks such as Modules/setup.local; when such a landmark is found relative to the executable, Python assumes it is running from a source tree and generates an alternate default sys.path. On Windows, builds under PCbuild/<arch> set VPATH to ...., producing a landmark path of ....\Modules\setup.local. Because this path can resolve outside the Python installation directory, an attacker with low privileges may be able to create the expected landmark and a malicious alternative Lib directory in a location discovered by Python. This can cause an otherwise restricted Python installation to resolve imports from attacker-controlled locations.