This advisory covers two security flaws in Python 3.12 as packaged by Red Hat for their Enterprise Linux 10.0 Extended Update Support and related products. CVE-2026-6100 is a use-after-free vulnerability in decompression modules that could allow arbitrary code execution or information disclosure. CVE-2026-4786 is a command injection vulnerability in the webbrowser.open() API that could lead to arbitrary code execution. Red Hat has released updated python3.12 packages to fix these issues. The advisory references Red Hat Bugzilla entries 2457932 and 2458049 for the respective CVEs. The update is classified as Important by Red Hat and affects multiple architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS base scores are included in the advisory, but the severity is assessed as high.

Successful exploitation of CVE-2026-6100 could result in arbitrary code execution or information disclosure due to a use-after-free flaw in decompression modules. CVE-2026-4786 could allow an attacker to execute arbitrary code via command injection through the webbrowser.open() API. Both vulnerabilities pose a significant risk to systems running the affected Python version on Red Hat Enterprise Linux 10.0 Extended Update Support and related products.

Red Hat has released updated python3.12 packages that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:16699 and the referenced article https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by Red Hat. Systems running the affected versions should be updated promptly to remediate these issues.