CVE-2026-12003

A flaw was found in Python. On Windows systems utilizing legacy installers, a low-privilege user can exploit insecure handling of the VPATH variable. This allows the user to create a specific landmark file outside the Python installation directory. Consequently, an alternative Lib folder can be introduced, leading to privilege escalation.

This Important privilege escalation flaw in Python's VPATH handling affects Windows systems utilizing legacy installers. Red Hat Enterprise Linux environments are not impacted as the vulnerable code path and cannot be exploited by an adversary.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.