This advisory covers two security vulnerabilities in Python 3.12 as packaged by Red Hat for Enterprise Linux 9.4. CVE-2026-6100 is a use-after-free vulnerability in decompression modules that could allow arbitrary code execution or information disclosure. CVE-2026-4786 is a command injection vulnerability in the webbrowser.open() API that could lead to arbitrary code execution. Red Hat has issued updated python3.12 packages that address these issues across multiple supported architectures and variants of Red Hat Enterprise Linux 9.4. The advisory references Red Hat Bugzilla entries 2457932 and 2458049 for the respective CVEs and provides links to updated packages and remediation instructions. No CVSS scores are included, and no active exploitation is known.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code or cause information disclosure on affected systems running vulnerable versions of python3.12. The use-after-free in decompression modules (CVE-2026-6100) and command injection in the webbrowser.open() API (CVE-2026-4786) both pose significant security risks. However, no known exploits are currently reported in the wild. The vulnerabilities affect Red Hat Enterprise Linux 9.4 and related product variants using python3.12.

Red Hat has released updated python3.12 packages that fix these vulnerabilities. Users should apply the security update for python3.12 as provided in Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions and other affected variants. Detailed update instructions are available at https://access.redhat.com/articles/11258. Applying these updates will remediate the vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.