CVE-2026-6100

Name of the Vulnerable Software and Affected Versions Python (affected versions not specified)

Description A use-after-free flaw exists in the decompression modules of Python, specifically within lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile. This issue occurs when a program re-uses a decompression object after a MemoryError is raised due to memory allocation failure, typically during periods of high memory pressure. A use-after-free is a condition where a program continues to use a pointer after it has been freed, which can lead to memory corruption. Exploitation of this flaw could allow an attacker to execute arbitrary code or access sensitive data. The issue is not present when using one-shot decompression helper functions such as lzma.decompress(), bz2.decompress(), gzip.decompress(), and zlib.decompress(), as these create a new instance for every call.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, avoid re-using decompressor instances across multiple calls if a MemoryError has occurred.