{"cve":"CVE-2024-3220","nvd":{"published":"2025-02-14T17:15:15.567","modified":"2026-10-26T01:17:14.450","status":"Deferred","description":"There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type.\n\nThis defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\\etc\\mime.types”).\n\nTo work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.","cvss_v4":{"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N","score":2.3},"cvss_v3":null,"cwes":["CWE-426"],"references":["https://github.com/python/cpython/commit/04a29bf8f9ff8526cd96cb7368400173303a390a","https://github.com/python/cpython/commit/2f00690fd5a75305e02c99628a41439179266f29","https://github.com/python/cpython/commit/35dd324f6e30735162a68cde84bb04a169004325","https://github.com/python/cpython/commit/5550519259656cbb8eeac09e3dbc0d5c248a4dea","https://github.com/python/cpython/commit/76f4555c4ff10f5dda58d6528c17787df41e256c"],"products":[],"source":"nvd","synced_at":"2026-10-26T01:35:02.680761403+00:00"},"epss":{"cve":"CVE-2024-3220","score":0.00596,"percentile":0.48178,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}