DEBIAN-CVE-2026-12003
To allow builds of Python to be run from an in-tree layout (rather than an installed file layout), the VPATH variable is defined at build time and used to locate certain landmarks - specifically, Modules/setup.local. When this landmark is found relative to VPATH relative to the executable, Python assumes it is running in a source tree and generates a different default sys.path. This code remains in release builds, so that release-ready builds can be built in-tree. On Windows, since builds are written to 'PCbuild/', the value of VPATH is set to '..\..', which results in a landmark of '..\..\Modules\setup.local'. This path is outside the install directory of Python, and may have different permissions, potentially allowing a low-privilege user to create the landmark and an alternative `Lib` folder that will be discovered by an otherwise restricted install. Such a setup occurs with the legacy default install location for all users (in the now superseded EXE installer), due to how Windows allows all users to create folders in the root directory of their OS drive. Our recommended mitigation on Windows is to migrate away from the legacy installer and use the new [Python install manager](https://www.python.org/downloads/latest/pymanager/) to install for the current user. Installs where the directory two levels above the Python installation directory have equivalent permissions are unaffected (in general, a per-user install cannot be modified at all by other users, removing any escala
DEBIAN-CVE-2026-12003
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-12003
python3.11
Source reference: /affected/0/package/name
- Affected versions
- 3.11.2-6
Source reference:
/affected/0/versions3.11.2-6+deb12u1Source reference:
/affected/0/versions3.11.2-6+deb12u2Source reference:
/affected/0/versions3.11.2-6+deb12u3Source reference:
/affected/0/versions3.11.2-6+deb12u4Source reference:
/affected/0/versions3.11.2-6+deb12u5Source reference:
/affected/0/versions3.11.2-6+deb12u6Source reference:
/affected/0/versions3.11.2-6+deb12u7Source reference:
/affected/0/versions3.11.2-6+deb12u8Source reference:
/affected/0/versions3.11.3-1Source reference:
/affected/0/versions3.11.3-2Source reference:
/affected/0/versions3.11.4-1Source reference:
/affected/0/versions3.11.5-1Source reference:
/affected/0/versions3.11.5-2Source reference:
/affected/0/versions3.11.5-3Source reference:
/affected/0/versions3.11.6-1Source reference:
/affected/0/versions3.11.6-2Source reference:
/affected/0/versions3.11.6-3Source reference:
/affected/0/versions3.11.6-3~hurd.2Source reference:
/affected/0/versions3.11.7-1Source reference:
/affected/0/versions3.11.7-2Source reference:
/affected/0/versions3.11.8-1Source reference:
/affected/0/versions3.11.8-1.1~exp1Source reference:
/affected/0/versions3.11.8-1.1~exp2Source reference:
/affected/0/versions3.11.8-2Source reference:
/affected/0/versions3.11.8-3Source reference:
/affected/0/versions3.11.8-3+hurd.1Source reference:
/affected/0/versions3.11.9-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
python3.13
Source reference: /affected/1/package/name
- Affected versions
- 3.13.11-1
Source reference:
/affected/1/versions3.13.12-1Source reference:
/affected/1/versions3.13.14-1Source reference:
/affected/1/versions3.13.15-1Source reference:
/affected/1/versions3.13.5-2Source reference:
/affected/1/versions3.13.5-2+deb13u1Source reference:
/affected/1/versions3.13.5-2+deb13u2Source reference:
/affected/1/versions3.13.5-2+deb13u3Source reference:
/affected/1/versions3.13.5-2+deb13u4Source reference:
/affected/1/versions3.13.5-2+deb13u5Source reference:
/affected/1/versions3.13.6-1Source reference:
/affected/1/versions3.13.7-1Source reference:
/affected/1/versions3.13.8-1Source reference:
/affected/1/versions3.13.9-1Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
python3.13
Source reference: /affected/2/package/name
- Affected versions
- 3.13.11-1
Source reference:
/affected/2/versions3.13.12-1Source reference:
/affected/2/versions3.13.14-1Source reference:
/affected/2/versions3.13.15-1Source reference:
/affected/2/versions3.13.5-2Source reference:
/affected/2/versions3.13.6-1Source reference:
/affected/2/versions3.13.7-1Source reference:
/affected/2/versions3.13.8-1Source reference:
/affected/2/versions3.13.9-1Source reference:
/affected/2/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
python3.14
Source reference: /affected/3/package/name
- Affected versions
- 3.14.0-1
Source reference:
/affected/3/versions3.14.0-2Source reference:
/affected/3/versions3.14.0-3Source reference:
/affected/3/versions3.14.0-4Source reference:
/affected/3/versions3.14.0-5Source reference:
/affected/3/versions3.14.0~a7-1Source reference:
/affected/3/versions3.14.0~b1-1Source reference:
/affected/3/versions3.14.0~b2-1Source reference:
/affected/3/versions3.14.0~b3-1Source reference:
/affected/3/versions3.14.0~b4-1Source reference:
/affected/3/versions3.14.0~rc1-1Source reference:
/affected/3/versions3.14.0~rc2-1Source reference:
/affected/3/versions3.14.0~rc3-1Source reference:
/affected/3/versions3.14.2-1Source reference:
/affected/3/versions3.14.3-1Source reference:
/affected/3/versions3.14.3-2Source reference:
/affected/3/versions3.14.3-3Source reference:
/affected/3/versions3.14.3-4Source reference:
/affected/3/versions3.14.3-5Source reference:
/affected/3/versions3.14.4-1Source reference:
/affected/3/versions3.14.4-2Source reference:
/affected/3/versions3.14.5-1Source reference:
/affected/3/versions3.14.5~rc1-1Source reference:
/affected/3/versions3.14.6-1Source reference:
/affected/3/versions3.14.7-1Source reference:
/affected/3/versions3.14.7-2Source reference:
/affected/3/versions3.14.7-3Source reference:
/affected/3/versions3.14.7-4Source reference:
/affected/3/versions3.14.7-5Source reference:
/affected/3/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python3.11",
"purl": "pkg:deb/debian/python3.11?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"3.11.2-6",
"3.11.2-6+deb12u1",
"3.11.2-6+deb12u2",
"3.11.2-6+deb12u3",
"3.11.2-6+deb12u4",
"3.11.2-6+deb12u5",
"3.11.2-6+deb12u6",
"3.11.2-6+deb12u7",
"3.11.2-6+deb12u8",
"3.11.3-1",
"3.11.3-2",
"3.11.4-1",
"3.11.5-1",
"3.11.5-2",
"3.11.5-3",
"3.11.6-1",
"3.11.6-2",
"3.11.6-3",
"3.11.6-3~hurd.2",
"3.11.7-1",
"3.11.7-2",
"3.11.8-1",
"3.11.8-1.1~exp1",
"3.11.8-1.1~exp2",
"3.11.8-2",
"3.11.8-3",
"3.11.8-3+hurd.1",
"3.11.9-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-12003.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python3.13",
"purl": "pkg:deb/debian/python3.13?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"3.13.11-1",
"3.13.12-1",
"3.13.14-1",
"3.13.15-1",
"3.13.5-2",
"3.13.5-2+deb13u1",
"3.13.5-2+deb13u2",
"3.13.5-2+deb13u3",
"3.13.5-2+deb13u4",
"3.13.5-2+deb13u5",
"3.13.6-1",
"3.13.7-1",
"3.13.8-1",
"3.13.9-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-12003.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python3.13",
"purl": "pkg:deb/debian/python3.13?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.13.11-1",
"3.13.12-1",
"3.13.14-1",
"3.13.15-1",
"3.13.5-2",
"3.13.6-1",
"3.13.7-1",
"3.13.8-1",
"3.13.9-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-12003.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "python3.14",
"purl": "pkg:deb/debian/python3.14?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"3.14.0-1",
"3.14.0-2",
"3.14.0-3",
"3.14.0-4",
"3.14.0-5",
"3.14.0~a7-1",
"3.14.0~b1-1",
"3.14.0~b2-1",
"3.14.0~b3-1",
"3.14.0~b4-1",
"3.14.0~rc1-1",
"3.14.0~rc2-1",
"3.14.0~rc3-1",
"3.14.2-1",
"3.14.3-1",
"3.14.3-2",
"3.14.3-3",
"3.14.3-4",
"3.14.3-5",
"3.14.4-1",
"3.14.4-2",
"3.14.5-1",
"3.14.5~rc1-1",
"3.14.6-1",
"3.14.7-1",
"3.14.7-2",
"3.14.7-3",
"3.14.7-4",
"3.14.7-5"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-12003.json"
},
"ecosystem_specific": {
"urgency": "unimportant"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #55465 · Revision 1
- Added to Heist Feed
- Publisher date