Two security vulnerabilities affecting Python 3.12 on Red Hat Enterprise Linux 9.6 are addressed in this advisory. CVE-2026-6100 is a use-after-free vulnerability in decompression modules that may allow arbitrary code execution or information disclosure. CVE-2026-4786 is a command injection vulnerability in the webbrowser.open() API that could lead to arbitrary code execution. These vulnerabilities have been fixed in updated python3.12 packages provided by Red Hat. The advisory covers multiple architectures and variants of Red Hat Enterprise Linux 9.6 Extended Update Support and related CodeReady Linux Builder packages.

Successful exploitation of CVE-2026-6100 could allow an attacker to execute arbitrary code or disclose sensitive information due to a use-after-free condition in decompression modules. Exploitation of CVE-2026-4786 could allow arbitrary code execution through command injection in the webbrowser.open() API. Both vulnerabilities pose a high security risk as they enable remote code execution or information disclosure on affected systems. No known exploits in the wild have been reported, but the vulnerabilities are rated as Important by Red Hat.

Red Hat has released updated python3.12 packages that address these vulnerabilities. Users of affected Red Hat Enterprise Linux 9.6 Extended Update Support and related products should apply the available security updates promptly. Detailed update instructions are available at https://access.redhat.com/articles/11258. Since this is not a cloud service, remediation requires applying the vendor-provided patches. Patch status is confirmed by the vendor advisory. No additional mitigations are specified beyond applying the update.