Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-u…
High CVSS 8.1
Summary
Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is rai…
In-depth triage · Auto channel
No in-depth report has been generated yet (DR-003 v2 AI pipeline is under construction).
Sources
- NVD DATABASE
Original Links
- https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e
- https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d
- https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2
- https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20
- https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b
- https://github.com/python/cpython/issues/148395
- https://github.com/python/cpython/pull/148396
- https://mail.python.org/archives/list/security-announce@python.org/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/
- http://www.openwall.com/lists/oss-security/2026/04/13/10
- https://access.redhat.com/errata/RHSA-2026:10117
- https://access.redhat.com/errata/RHSA-2026:10140
- https://access.redhat.com/errata/RHSA-2026:10141
- https://access.redhat.com/errata/RHSA-2026:10711
- https://access.redhat.com/errata/RHSA-2026:10745
- https://access.redhat.com/errata/RHSA-2026:10774
- https://access.redhat.com/errata/RHSA-2026:10949
- https://access.redhat.com/errata/RHSA-2026:10950
- https://access.redhat.com/errata/RHSA-2026:11062
- https://access.redhat.com/errata/RHSA-2026:11077
- https://access.redhat.com/errata/RHSA-2026:11768
- https://access.redhat.com/errata/RHSA-2026:13692
- https://access.redhat.com/errata/RHSA-2026:13812
- https://access.redhat.com/errata/RHSA-2026:14652
- https://access.redhat.com/errata/RHSA-2026:14653
- https://access.redhat.com/errata/RHSA-2026:14656
- https://access.redhat.com/errata/RHSA-2026:16699
- https://access.redhat.com/errata/RHSA-2026:17525
- https://access.redhat.com/errata/RHSA-2026:17619
- https://access.redhat.com/errata/RHSA-2026:19019
- https://access.redhat.com/errata/RHSA-2026:19064
- https://access.redhat.com/errata/RHSA-2026:19175
- https://access.redhat.com/errata/RHSA-2026:19176
- https://access.redhat.com/errata/RHSA-2026:19177
- https://access.redhat.com/errata/RHSA-2026:19216
- https://access.redhat.com/errata/RHSA-2026:19549
- https://access.redhat.com/errata/RHSA-2026:19570
- https://access.redhat.com/errata/RHSA-2026:19571
- https://access.redhat.com/errata/RHSA-2026:19576
- https://access.redhat.com/errata/RHSA-2026:19590
- https://access.redhat.com/errata/RHSA-2026:21275
- https://access.redhat.com/errata/RHSA-2026:21682
- https://access.redhat.com/errata/RHSA-2026:25096
- https://access.redhat.com/errata/RHSA-2026:26187
- https://access.redhat.com/errata/RHSA-2026:30078
- https://access.redhat.com/errata/RHSA-2026:30087
- https://access.redhat.com/errata/RHSA-2026:30088
- https://access.redhat.com/errata/RHSA-2026:30089
- https://access.redhat.com/errata/RHSA-2026:8822
- https://access.redhat.com/errata/RHSA-2026:8824
- https://access.redhat.com/errata/RHSA-2026:9228
- https://access.redhat.com/security/cve/CVE-2026-6100
- https://bugzilla.redhat.com/show_bug.cgi?id=2457932
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-6100.json
- https://github.com/python/cpython/commit/ea8d735eb084cf8cc021df1a30e90d10a8f052e3
- https://access.redhat.com/errata/RHSA-2026:52400
Timeline
- nvd_ingest NVD