CVE-2026-6100

April 14, 2026, 3:16 p.m.

9.1
Critical

Description

Use-after-free (UAF) was possible in the `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `gzip.GzipFile` when a memory allocation fails with a `MemoryError` and the decompression instance is re-used. This scenario can be triggered if the process is under memory pressure. The fix cleans up the dangling pointer in this specific error condition. The vulnerability is only present if the program re-uses decompressor instances across multiple decompression calls even after a `MemoryError` is raised during decompression. Using the helper functions to one-shot decompress data such as `lzma.decompress()`, `bz2.decompress()`, `gzip.decompress()`, and `zlib.decompress()` are not affected as a new decompressor instance is used per call. If the decompressor instance is not re-used after an error condition, this usage is similarly not vulnerable.

Product(s) Impacted

Vendor Product Versions
Python
  • Lzma
  • Bz2
  • Gzip
  • *
  • *
  • *

Weaknesses

Common security weaknesses mapped to this vulnerability.

CWE-416
Use After Free
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.

*CPE(s)

Affected systems and software identified for this CVE.

Type Vendor Product Version Update Edition Language Software Edition Target Software Target Hardware Other Information
a python lzma / / / / / / / /
a python bz2 / / / / / / / /
a python gzip / / / / / / / /

References

https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e
https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d
https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2
https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20
https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b
https://github.com/python/cpython/issues/148395
https://github.com/python/cpython/pull/148396
https://mail.python.org/archives/list/[email protected]/thread/HTWB2Z6KT5QQX4RYEZAFININDHNOSIF3/
http://www.openwall.com/lists/oss-security/2026/04/13/10

Tags

CWE-416
[email protected]
2026-04-13
CVE-2026-6100

CVSS Score

9.1 / 10

CVSS Data - 4.0

  • Attack Vector: NETWORK
  • Attack Complexity: HIGH
  • Attack Requirements: PRESENT
  • Privileges Required: NONE
  • User Interaction: NONE
  • Scope:
  • Confidentiality Impact: HIGH
  • Integrity Impact: HIGH
  • Availability Impact: NONE
  • Exploit Maturity: NOT_DEFINED

    • CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

    View Vector String

Timeline

Published: April 13, 2026, 6:16 p.m.
Last Modified: April 14, 2026, 3:16 p.m.

Status : Received

CVE has been recently published to the CVE List and has been received by the NVD.

More info

Source

[email protected]

*Disclaimer: Some vulnerabilities do not have an associated CPE. To enhance the data, we use AI to infer CPEs based on CVE details. This is an automated process and might not always be accurate.