The advisory covers two security flaws in Python 3 on Red Hat Enterprise Linux 8.6. CVE-2026-6100 is a use-after-free vulnerability in decompression modules that can lead to arbitrary code execution or information disclosure. CVE-2026-4786 is a command injection vulnerability in the webbrowser.open() API that allows arbitrary code execution. Both vulnerabilities are addressed in updated python3 packages provided by Red Hat. The advisory references Red Hat's errata RHSA-2026:17619 and directs users to apply the update to mitigate these issues.

Successful exploitation of CVE-2026-6100 could allow attackers to execute arbitrary code or disclose sensitive information due to a use-after-free flaw in decompression modules. CVE-2026-4786 could enable arbitrary code execution through command injection in the webbrowser.open() API. Both vulnerabilities pose a high security risk on affected systems running vulnerable Python 3 versions on Red Hat Enterprise Linux 8.6.

Red Hat has released updated python3 packages for Red Hat Enterprise Linux 8.6 that address these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:17619 and the referenced article https://access.redhat.com/articles/11258. There is no indication that these issues are already mitigated or require no action. Patch status is confirmed by the vendor advisory. No known exploits in the wild have been reported at this time.