{"id":"CVE-2018-1000117","aliases":["EUVD-2018-1844","GHSA-9wwx-vjm7-9x2m","PSF-2022-2"],"status":"published","title":"Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer...","description":"Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python script that creates a symlink with an attacker controlled name or location. This vulnerability appears to have been fixed in 3.7.0 and 3.6.5.","severity":{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.0104,"percentile":0.64241,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":false},"cwes":["CWE-119","CWE-120"],"published":"2018-03-07T14:00:00Z","modified":"2026-10-20T10:49:37Z","exploits":[{"source":"pocgithub","id":"u0pattern/CVE-2018-1000117-Exploit","title":"u0pattern/CVE-2018-1000117-Exploit","date":"2018-06-05","url":"https://github.com/u0pattern/CVE-2018-1000117-Exploit"}],"products":[{"vendor":"python","product":"python"}],"references":[{"url":"https://github.com/python/cpython/pull/5989","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Vendor Advisory","fix"]},{"url":"https://bugs.python.org/issue33001","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","fix","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2018-1000117"},{"url":"https://github.com/advisories/GHSA-9wwx-vjm7-9x2m"},{"url":"https://mail.python.org/mm3/archives/list/security-announce@python.org/thread/PVSURQ2YCNZODILA3QE7ZF3GCD25EVVT/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2018-1000117","description":"Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python script that creates a symlink with an attacker controlled name or location. This vulnerability appears to have been fixed in 3.7.0 and 3.6.5.","status":"published","published":"2018-03-07T14:00:00Z","modified":"2024-09-17T01:37:10.621Z","updated_at":"2026-11-02T14:35:10.685174Z"}],"euvd":[{"id":"EUVD-2018-1844","description":"Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python script that creates a symlink with an attacker controlled name or location. This vulnerability appears to have been fixed in 3.7.0 and 3.6.5.","status":"published","published":"2018-03-07T14:00:00Z","modified":"2024-09-17T01:37:10Z","updated_at":"2026-11-03T00:28:47.904483Z"}],"ghsa":[{"id":"GHSA-9wwx-vjm7-9x2m","title":"Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer...","description":"Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python script that creates a symlink with an attacker controlled name or location. This vulnerability appears to have been fixed in 3.7.0 and 3.6.5.","status":"published","published":"2022-05-14T03:34:29Z","modified":"2023-01-27T05:02:15Z","cvss":[{"version":"3.0","score":6.7,"vector":"CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"cwes":["CWE-119","CWE-120"],"updated_at":"2026-11-02T14:42:02.546908Z"}],"nvd":[{"id":"CVE-2018-1000117","description":"Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python script that creates a symlink with an attacker controlled name or location. This vulnerability appears to have been fixed in 3.7.0 and 3.6.5.","status":"published","published":"2018-03-07T14:29:00.28Z","modified":"2026-06-17T01:32:27.763Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:04:23.783914Z"}],"osv":[{"id":"CVE-2018-1000117","description":"Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python script that creates a symlink with an attacker controlled name or location. This vulnerability appears to have been fixed in 3.7.0 and 3.6.5.","status":"published","published":"2018-03-07T14:29:00.28Z","modified":"2026-10-20T10:49:37.219994258Z","cvss":[{"version":"3.1","score":6.7,"vector":"CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"medium"}],"updated_at":"2026-11-02T15:44:07.192756Z"},{"id":"PSF-2022-2","title":"Buffer overflow vulnerability in os.symlink on Windows","description":"Python Software Foundation CPython version From 3.2 until 3.6.4 on Windows contains a Buffer Overflow vulnerability in os.symlink() function on Windows that can result in Arbitrary code execution, likely escalation of privilege. This attack appears to be exploitable via a python script that creates a symlink with an attacker controlled name or location. This vulnerability appears to have been fixed in 3.7.0 and 3.6.5.","status":"published","published":"2022-10-03T16:21:59Z","modified":"2025-10-09T01:03:51.445514Z","updated_at":"2026-11-02T15:52:50.263679Z"}]}}