diff --git a/Lib/mimetypes.py b/Lib/mimetypes.py
index 1d6b33fe854c943..561b99a92c8d16b 100644
--- a/Lib/mimetypes.py
+++ b/Lib/mimetypes.py
@@ -23,6 +23,8 @@
 read_mime_types(file) -- parse one file, return a dictionary or None
 """
 
+import sys
+
 try:
     from _winapi import _mimetypes_read_windows_registry
 except ImportError:
@@ -40,17 +42,23 @@
     "suffix_map", "encodings_map", "types_map", "common_types"
 ]
 
-knownfiles = [
-    "/etc/mime.types",
-    "/etc/httpd/mime.types",                    # Mac OS X
-    "/etc/httpd/conf/mime.types",               # Apache
-    "/etc/apache/mime.types",                   # Apache 1
-    "/etc/apache2/mime.types",                  # Apache 2
-    "/usr/local/etc/httpd/conf/mime.types",
-    "/usr/local/lib/netscape/mime.types",
-    "/usr/local/etc/httpd/conf/mime.types",     # Apache 1.2
-    "/usr/local/etc/mime.types",                # Apache 1.3
-    ]
+if sys.platform == "win32":
+    # The default paths would resolve to the root of the current drive on Windows
+    # (e.g. C:\etc\mime.types), which unprivileged users can usually create.
+    # Only the registry is used by default.
+    knownfiles = []
+else:
+    knownfiles = [
+        "/etc/mime.types",
+        "/etc/httpd/mime.types",                    # Mac OS X
+        "/etc/httpd/conf/mime.types",               # Apache
+        "/etc/apache/mime.types",                   # Apache 1
+        "/etc/apache2/mime.types",                  # Apache 2
+        "/usr/local/etc/httpd/conf/mime.types",
+        "/usr/local/lib/netscape/mime.types",
+        "/usr/local/etc/httpd/conf/mime.types",     # Apache 1.2
+        "/usr/local/etc/mime.types",                # Apache 1.3
+        ]
 
 inited = False
 _db = None
diff --git a/Lib/test/test_mimetypes.py b/Lib/test/test_mimetypes.py
index 1e0f6664af0d066..8e39552dba8aa89 100644
--- a/Lib/test/test_mimetypes.py
+++ b/Lib/test/test_mimetypes.py
@@ -271,6 +271,10 @@ def test_init_knownfiles(self):
         mimetypes.init()
         self.assertEqual(guess_file_type("file.test2")[0], "testing/test2")
 
+    @unittest.skipIf(sys.platform == "win32", "non-Windows only")
+    def test_default_knownfiles(self):
+        self.assertIn("/etc/mime.types", knownfiles)
+
     def test_added_types_are_used(self):
         mimetypes.add_type('testing/default-type', '')
         mime_type, _ = mimetypes.guess_type('')
@@ -555,6 +559,9 @@ def test_registry_parsing(self):
         eq(self.db.guess_type("image.jpg"), ("image/jpeg", None))
         eq(self.db.guess_type("image.png"), ("image/png", None))
 
+    def test_default_knownfiles(self):
+        self.assertEqual(knownfiles, [])
+
     @unittest.skipIf(not hasattr(_winapi, "_mimetypes_read_windows_registry"),
                      "read_windows_registry accelerator unavailable")
     def test_registry_accelerator(self):
diff --git a/Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst b/Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst
new file mode 100644
index 000000000000000..d481ed2b74a20ea
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst
@@ -0,0 +1,2 @@
+:mod:`mimetypes` no longer reads the files listed in :data:`mimetypes.knownfiles`
+by default on Windows, and uses only the registry.