CVE-2020-15523 is an invalid search path in Python 3.6 and later on
Windows. It occurs during Py_Initialize() when the runtime attempts to
pre-load python3.dll. If Py_SetPath() has been called, the expected
location is not set, and locations elsewhere on the user's system will
This issue is not triggered when running python.exe. It only applies
when CPython has been embedded in another application.
The next patched releases will be: 3.9.0b5, 3.8.4, 3.7.9 (source only),
3.6.12 (source only)
Other than applying the patch, applications may mitigate the
vulnerability by explicitly calling LoadLibrary() on their copy of
python3.dll before calling Py_Initialize(). Even with the patch applied,
applications should include a copy of python3.dll alongside their main
Thanks to Eric Gantumur for detecting and reporting the issue to the
Python Security Response Team.
Questions to security-sig(a)python.org or security(a)python.org.
Python Security Response Team