CVE-2026-6100 — Use After Free in Software Foundation Cpython

CWE-416 — Use After FreeCWE-787 — Out-of-bounds WriteCWE-825 — Expired Pointer Dereference18 documents6 sources
Severity
9.1CRITICALNVD
EPSS
0.1%
top 79.68%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Python Software Foundation Cpython
Timeline
PublishedApr 13

Description

Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is rais…

CVSS vector

CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N

Affected Packages1 packages

🔴Vulnerability Details

3
GHSA
GHSA-pg25-7cx5-cvcm: Use-after-free (UAF) was possible in the `lzma↗2026-04-13
▶
CVEList
Use-after-free in lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile after re-use under memory pressure↗2026-04-13
▶
VulDB
Python CPython up to 3.14.x Decompression Call use after free (ID 148395)↗2026-04-13
▶

📋Vendor Advisories

1
Red Hat
python: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules↗2026-04-13
▶

💬Community

13
Bugzilla
CVE-2026-6100 python3.13: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [epel-all]↗2026-04-13
▶
Bugzilla
CVE-2026-6100 mingw-python3: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]↗2026-04-13
▶
Bugzilla
CVE-2026-6100 python3.14: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]↗2026-04-13
▶
Bugzilla
CVE-2026-6100 python3.13: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [fedora-all]↗2026-04-13
▶
Bugzilla
CVE-2026-6100 asahi-installer: Python: Arbitrary code execution or information disclosure via use-after-free in decompression modules [epel-all]↗2026-04-13
▶
CVE-2026-6100 — Use After Free | cvebase