PT-2026-32487 · Python+1 · Cpython+1

Ryan Hileman

+2

·

Published

2026-04-13

·

Updated

2026-05-19

·

CVE-2026-6100

CVSS v4.0

9.1

Critical

VectorAV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions CPython (affected versions not specified)
Description A use-after-free (UAF) issue exists in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile. This occurs when a memory allocation fails with a MemoryError and the decompression instance is subsequently reused, typically under memory pressure. Use-after-free is a condition where a program continues to use a memory address after it has been released. This issue does not affect the use of one-shot decompression helper functions such as lzma.decompress(), bz2.decompress(), gzip.decompress(), and zlib.decompress(), nor does it affect cases where decompressor instances are not reused after an error.
Recommendations Avoid reusing decompressor instances across multiple decompression calls after a MemoryError is raised. Use helper functions such as lzma.decompress(), bz2.decompress(), gzip.decompress(), and zlib.decompress() to perform one-shot decompression. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Use After Free

Memory Corruption

Weakness Enumeration

Related Identifiers

ALSA-2026:10711
ALSA-2026:10745
ALSA-2026:10774
ALSA-2026:10949
ALSA-2026:10950
ALSA-2026:11062
ALSA-2026:11077
ALSA-2026:19019
ALSA-2026:19064
ALSA-2026:19175
ALSA-2026:19176
ALSA-2026:19177
ALSA-2026:19216
BDU:2026-05838
BIT-LIBPYTHON-2026-6100
BIT-PYTHON-2026-6100
BIT-PYTHON-MIN-2026-6100
CVE-2026-6100
ECHO-5806-1424-7B47
OESA-2026-2115
OESA-2026-2116
OESA-2026-2117
OPENSUSE-SU-2026:10647-1
OPENSUSE-SU-2026:10648-1
OPENSUSE-SU-2026:10667-1
PSF-2026-18
RHSA-2026:10117
RHSA-2026:10711
RHSA-2026:10745
RHSA-2026:10774
RHSA-2026:10949
RHSA-2026:10950
RHSA-2026:11062
RHSA-2026:11077
RHSA-2026:13692
RHSA-2026:14652
RHSA-2026:14653
RHSA-2026:14656
RHSA-2026:8822
RHSA-2026:8824
RHSA-2026:9228

Affected Products

Cpython
Rocky Linux