CLEANSTART-2026-AZ15174: There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause Mem...
Security vulnerability affects the miniforge3 package. There is a defect in the CPython standard library module “mimetypes” where on Windows the default list of known file locations are writable meaning other users can create invalid files to cause MemoryError to be raised on Python runtime startup or have file extensions be interpreted as the incorr....
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
cleanstart/miniforge3to a version that resolves this vulnerability.Fixed in 26.1.1.3-r4
Frequently Asked Questions
Which systems are realistically exposed?
Windows systems using the affected miniforge3 package are exposed when other users can write files into locations consulted by the default mimetypes configuration.
What access does an attacker need?
An attacker needs the ability to create invalid files in the writable known file locations used by mimetypes. This can cause a MemoryError during Python runtime startup or alter how file extensions are interpreted.
Is a non-default mimetypes configuration required for exploitation?
No. The issue involves the default list of known file locations on Windows when those locations are writable by other users.