---
id: CVE-2024-3220
title: >-
  There is a defect in the CPython standard library module “mimetypes” where on
  Windows the default list of known file locations are writable meaning other
  users can create invalid files to cause MemoryError to be raised on Python
  runtime …
summary: >-
  There is a defect in the CPython standard library module “mimetypes” where on
  Windows the default list of known file locations are writable meaning other
  users can create invalid files to cause MemoryError to be raised on Python
  runtime …
severity: low
cwe:
  - CWE-426
published: '2025-02-14'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T19:16:58.283'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-3220'
references:
  - url: 'https://github.com/python/cpython/issues/159428'
    label: cna@python.org
  - url: >-
      https://mail.python.org/archives/list/security-announce@python.org/thread/CDXW34ND2LSAOYAR5N6UNONP4ZBX4D6R/
    label: cna@python.org
  - url: 'http://www.openwall.com/lists/oss-security/2025/02/14/8'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: 'https://security.netapp.com/advisory/ntap-20250314-0001/'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://github.com/python/cpython/commit/04a29bf8f9ff8526cd96cb7368400173303a390a
  - url: >-
      https://github.com/python/cpython/commit/5550519259656cbb8eeac09e3dbc0d5c248a4dea
  - url: >-
      https://github.com/python/cpython/commit/76f4555c4ff10f5dda58d6528c17787df41e256c
  - url: >-
      https://github.com/python/cpython/commit/2f00690fd5a75305e02c99628a41439179266f29
  - url: >-
      https://github.com/python/cpython/commit/35dd324f6e30735162a68cde84bb04a169004325
  - url: >-
      https://github.com/python/cpython/commit/8d4286a3f41d36f42c4b4cf5c4451a5a8c23fe87
tags:
  - nvd
  - cve.org
epss: 0.00715
epssPercentile: 0.53531
ingestedAt: '2026-10-14T19:49:57.533Z'
vendor: Python Software Foundation
product: CPython
affected:
  - CPython < 3.16.0
cvss: 2.3
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N'
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2025-02-14T16:46:00.511698Z'
cvssSource: cna
---

## Overview

There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorrect file type.

This defect is caused by the default locations of Linux and macOS platforms (such as “/etc/mime.types”) also being used on Windows, where they are user-writable locations (“C:\etc\mime.types”).

To work-around this issue a user can call mimetypes.init() with an empty list (“[]”) on Windows platforms to avoid using the default list of known file locations.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.