PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

[CVE-2026-12003] Python Software Foundation - Python 3.11.0a3 to 3.15.0b2

bishopfox.com | vulnerability | Medium | CVE-2026-12003 | #privilege-escalation | #windows | #python | #vulnerability | #bishop-fox | #cve-2026-12003
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Bishop Fox discloses CVE-2026-12003, a Windows-only CPython path-construction flaw letting a low-privilege user hijack execution when a privileged account runs Python; fixed in 3.13.15, 3.14.7 and 3.15.0b3.
CVE
CVE-2026-12003
CVSS
5.3
Published
Collected

Related coverage

vulnerability · about.gitlab.com
Pillow CVE-2026-112900: How to find and fix it with GitLab
Upgrade to Pillow 13.0.0, then use dependency scanning, code search, and GitLab Duo Agent Platform to patch every affected Python project in your groups.
High · vulnerability · codeberg.org
cowcups: CUPS cups-fontpath Local Privilege Escalation (LPE) to Root PoC
Demonstrates an effective local root privilege escalation chain in default CUPS environments by abusing printer discovery and Ghostscript font search paths.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
vulnerability · volexity.com
[CVE-2026-104935] A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days
# A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days October 13, 2026 Charlie Gardner, Sean Koessel, Steven Adair, and Volexity Volcano Team **_Volexity...
High · vulnerability · github.com
GOG Galaxy Local Privilege Escalation (LPE) PoC via DLL Search-Order Hijacking
Demonstrates persistent DLL hijacking vulnerabilities in popular gaming clients, showing how insecure service configurations and missing safe DLL search controls allow standard users to breach SYSTEM privilege boundaries.
research · github.com
Infinity Core: Linux Kernel Core Subsystems LPE and Container Escape Research
Unlike most modern Linux kernel exploits that depend on networking, eBPF, or unprivileged user namespaces, these vulnerabilities reside in fundamental kernel core subsystems, rendering standard container sandboxes and Android application domain restrictions ineffective against local privilege escalation.
Back