---
id: CVE-2020-8315
title: >-
  In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through
  3.8.1, an insecure dependency load upon launch on Windows 7 may result in an
  attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used
  instead of t…
summary: >-
  In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through
  3.8.1, an insecure dependency load upon launch on Windows 7 may result in an
  attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used
  instead of t…
severity: medium
cvss: 5.5
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N'
cwe:
  - CWE-427
vendor: python
product: python
affected:
  - 'python >= 3.6.0, <= 3.6.10'
  - 'python >= 3.7.0, <= 3.7.6'
  - 'python >= 3.8.0, <= 3.8.1'
published: '2020-01-28'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T09:17:21.327'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2020-8315'
references:
  - url: 'https://bugs.python.org/issue39401'
    label: cve@mitre.org
  - url: 'https://bugs.python.org/issue39401'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://cert-portal.siemens.com/productcert/html/ssa-398330.html'
    label: 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
tags:
  - nvd
  - cve.org
epss: 0.01509
epssPercentile: 0.74287
ingestedAt: '2026-10-14T09:24:26.051Z'
---

## Overview

In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacker's copy of api-ms-win-core-path-l1-1-0.dll being loaded and used instead of the system's copy. Windows 8 and later are unaffected.

## Affected

- `python >= 3.6.0, <= 3.6.10`
- `python >= 3.7.0, <= 3.7.6`
- `python >= 3.8.0, <= 3.8.1`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.