Loading vulnerability…
Untrusted MIME Configuration Loading in CPython on Windows
CVE-2024-3220 affects the CPython standard library mimetypes module on Windows. Its default knownfiles list includes MIME configuration locations intended for Linux and macOS that can resolve to locations writable by other users on Windows. An attacker who can create or modify files at these locations can supply malformed MIME configuration data that raises MemoryError during application startup or alters file-extension-to-MIME-type mappings.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation can prevent affected Python applications from starting or disrupt initialization through MemoryError. It can also compromise MIME-type identification by causing file extensions to resolve to attacker-selected or incorrect types. Further consequences depend on how an application uses those MIME mappings; arbitrary code execution is not established.
If you can’t patch tonight, do this now.
On Windows, explicitly call mimetypes.init([]) before MIME-type lookups to initialize the module without reading its default list of known file locations.
Patch, then assume compromise.
Upgrade to a CPython release containing the Windows mimetypes fix. Identified releases containing the fix include Python 3.11.18, 3.12.16, 3.13.18, 3.14.9, and 3.15.1. The corrected behavior prevents mimetypes on Windows from loading potentially user-modifiable files from the default knownfiles list.
No public exploits tracked yet. Mallory keeps watching.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.