This advisory covers two security vulnerabilities in python3.12 as packaged by Red Hat for RHEL 9.6 EUS. CVE-2026-6100 is a use-after-free vulnerability in decompression modules that can lead to arbitrary code execution or information disclosure. CVE-2026-4786 is a command injection vulnerability in the webbrowser.open() API that can also result in arbitrary code execution. Red Hat has released updated python3.12 packages (version 3.12.9-1.el9_6.8) that fix these issues. The advisory applies to multiple RHEL 9.6 Extended Update Support and Update Services for SAP Solutions variants across architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS scores are provided in the advisory, but Red Hat rates the impact as Important.

Successful exploitation of CVE-2026-6100 could allow an attacker to execute arbitrary code or disclose sensitive information due to a use-after-free flaw in decompression modules. CVE-2026-4786 could enable arbitrary code execution via command injection in the webbrowser.open() API. Both vulnerabilities pose a high risk of compromise on affected systems running vulnerable python3.12 versions. There are no known exploits in the wild at the time of the advisory.

Red Hat has released updated python3.12 packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.6 Extended Update Support and related CodeReady Linux Builder products should apply the python3.12 update to version 3.12.9-1.el9_6.8 or later as provided by Red Hat. Refer to the Red Hat advisory RHSA-2026:14656 and the update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps. No additional mitigations are indicated by the vendor advisory.