diff --git a/Lib/mimetypes.py b/Lib/mimetypes.py
index 814b3f9c9f9ecc1..a3d2f80d417e586 100644
--- a/Lib/mimetypes.py
+++ b/Lib/mimetypes.py
@@ -45,17 +45,23 @@
     "suffix_map", "encodings_map", "types_map", "common_types"
 ]
 
-knownfiles = [
-    "/etc/mime.types",
-    "/etc/httpd/mime.types",                    # Mac OS X
-    "/etc/httpd/conf/mime.types",               # Apache
-    "/etc/apache/mime.types",                   # Apache 1
-    "/etc/apache2/mime.types",                  # Apache 2
-    "/usr/local/etc/httpd/conf/mime.types",
-    "/usr/local/lib/netscape/mime.types",
-    "/usr/local/etc/httpd/conf/mime.types",     # Apache 1.2
-    "/usr/local/etc/mime.types",                # Apache 1.3
-    ]
+if sys.platform == "win32":
+    # The default paths would resolve to the root of the current drive on Windows
+    # (e.g. C:\etc\mime.types), which unprivileged users can usually create.
+    # Only the registry is used by default.
+    knownfiles = []
+else:
+    knownfiles = [
+        "/etc/mime.types",
+        "/etc/httpd/mime.types",                    # Mac OS X
+        "/etc/httpd/conf/mime.types",               # Apache
+        "/etc/apache/mime.types",                   # Apache 1
+        "/etc/apache2/mime.types",                  # Apache 2
+        "/usr/local/etc/httpd/conf/mime.types",
+        "/usr/local/lib/netscape/mime.types",
+        "/usr/local/etc/httpd/conf/mime.types",     # Apache 1.2
+        "/usr/local/etc/mime.types",                # Apache 1.3
+        ]
 
 inited = False
 _db = None
diff --git a/Lib/test/test_mimetypes.py b/Lib/test/test_mimetypes.py
index c366698b21b460b..0dd4e97fff962a8 100644
--- a/Lib/test/test_mimetypes.py
+++ b/Lib/test/test_mimetypes.py
@@ -50,6 +50,10 @@ def test_default_data(self):
         eq(self.db.guess_type("foo.tar.bz2"), ("application/x-tar", "bzip2"))
         eq(self.db.guess_type("foo.tar.xz"), ("application/x-tar", "xz"))
 
+    @unittest.skipIf(sys.platform == "win32", "non-Windows only")
+    def test_default_knownfiles(self):
+        self.assertIn("/etc/mime.types", knownfiles)
+
     def test_data_urls(self):
         eq = self.assertEqual
         guess_type = self.db.guess_type
@@ -296,6 +300,9 @@ def test_registry_parsing(self):
         eq(self.db.guess_type("image.jpg"), ("image/jpeg", None))
         eq(self.db.guess_type("image.png"), ("image/png", None))
 
+    def test_default_knownfiles(self):
+        self.assertEqual(knownfiles, [])
+
     @unittest.skipIf(not hasattr(_winapi, "_mimetypes_read_windows_registry"),
                      "read_windows_registry accelerator unavailable")
     def test_registry_accelerator(self):
diff --git a/Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst b/Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst
new file mode 100644
index 000000000000000..d481ed2b74a20ea
--- /dev/null
+++ b/Misc/NEWS.d/next/Security/2026-10-15-03-47-08.gh-issue-159428.XHRKwY.rst
@@ -0,0 +1,2 @@
+:mod:`mimetypes` no longer reads the files listed in :data:`mimetypes.knownfiles`
+by default on Windows, and uses only the registry.