Red Hat Product Security issued an advisory (RHSA-2026:16699) for python3.12 on Red Hat Enterprise Linux 10.0 EUS addressing two vulnerabilities: CVE-2026-6100, a use-after-free in decompression modules leading to potential arbitrary code execution or information disclosure, and CVE-2026-4786, a command injection vulnerability in the webbrowser.open() API allowing arbitrary code execution. The advisory includes updated python3.12 packages for multiple architectures and variants of RHEL 10.0 EUS. The vulnerabilities are categorized under CWE-88 (Improper Neutralization of Argument Delimiters in a Command) and CWE-825 (Use After Free). The update is classified as Important severity by Red Hat. No CVSS scores are provided, and no known exploits have been reported.

Successful exploitation of CVE-2026-6100 could allow an attacker to execute arbitrary code or disclose sensitive information due to a use-after-free vulnerability in Python's decompression modules. CVE-2026-4786 could enable arbitrary code execution through command injection in the webbrowser.open() API. Both vulnerabilities affect Python 3.12 on Red Hat Enterprise Linux 10.0 Extended Update Support. No known exploits in the wild have been reported, but the potential impact is high due to the possibility of arbitrary code execution.

Red Hat has released updated python3.12 packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 10.0 Extended Update Support should apply the available security update as described in the Red Hat advisory RHSA-2026:16699 and the referenced article https://access.redhat.com/articles/11258. Applying this official update remediates the issues. No additional mitigation steps are indicated by the vendor advisory.