This advisory covers two security flaws in python3.12 as packaged by Red Hat for RHEL 9.6 EUS. CVE-2026-6100 is a use-after-free vulnerability in decompression modules that could lead to arbitrary code execution or information disclosure. CVE-2026-4786 is a command injection vulnerability in the webbrowser.open() API that could allow arbitrary code execution. Red Hat has released updated python3.12 packages (version 3.12.9-1.el9_6.8) to fix these issues. The advisory applies to multiple RHEL 9.6 Extended Update Support variants and CodeReady Linux Builder variants across architectures including x86_64, s390x, ppc64le, and aarch64.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code or disclose sensitive information on affected systems running vulnerable versions of python3.12. The use-after-free in decompression modules and command injection in the webbrowser.open() API represent significant security risks, potentially leading to system compromise or data leakage.

Red Hat has released updated python3.12 packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.6 Extended Update Support and related variants should apply the python3.12 update to version 3.12.9-1.el9_6.8 or later as provided by Red Hat. Refer to the official Red Hat advisory RHSA-2026:14656 and the update instructions at https://access.redhat.com/articles/11258 for detailed remediation steps. No additional mitigation is required beyond applying the official update.