SECUFOCUSNOW
Home›CVE index›CVE-2026-6100
Review reviewCritical

CVE-2026-6100

Python Software Foundation CPython, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support

Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.deco...

CVSS
9.1
EPSS
0.58%
43.7% percentile
CISA KEV
Not listed
Published
2026.04.14
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability0.58%
Technical severityCVSS 9.1

Vulnerability overview

Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.deco...

Affected product and versions

Product
Python Software Foundation CPython, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support
Affected versions
< 3.13.14, >= 3.14.0a1 < 3.14.5rc1, >= 3.15.0a1 < 3.15.0b1
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Python Software Foundation CPython, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CWE
CWE-416, CWE-787, CWE-825