Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() functio…

published 2018-03-07 8 y ago modified 2026-06-17 4 mo ago also EUVD-2018-1844

cvss: 6.7; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 64%
public exploits: 0; none known

Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python script that creates a symlink with an attacker controlled name or location. This vulnerability appears to have been fixed in 3.7.0 and 3.6.5.

Patch / fix

fixed in 1 links 2

python python 3.4.9, 3.5.6, 3.6.5

github.com/python/cpython#5989 pull request
bugs.python.org/issue33001 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

cisa ICSA-19-155-01 updated 2019-06-04 cvss 6.7

PHOENIX CONTACT PLCNext AXC F 2152

Phoenix Contact AXC F 2152 2404267 version 1.x, 1046568 (Starterkit) version 1.x
affected: vendor fix, mitigation “Phoenix Contact recommends affected users update to firmware release 2019.0 LTS or later, update to PLCNext Engineer release 2019.0 LTS or later, and apply the following specific mitigations below:” phoenixcontact.com

From CISA ICS and IT advisories (CSAF, https://github.com/cisagov/CSAF), a U.S. Government work; changed: reduced to products, statuses and remediations. CISA notification · csaf

Exploit prediction

1.04% chance of exploitation in the next 30 days, higher than 64% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	6.7	CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD	2.0	7.2	AV:L/AC:L/Au:N/C:C/I:C/A:C

Classification

Weakness

CWE-120 Buffer Copy without Checking Size of Input

References

github.com /python/cpython/pull/5989
issue-tracking, patch, vendor-advisory
bugs.python.org /issue33001
issue-tracking, patch, third-party-advisory

Sources

CVE List CVE-2018-1000117
NVD CVE-2018-1000117

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary