This advisory addresses two security vulnerabilities in the python3.9 package for Red Hat Enterprise Linux 9.2. CVE-2026-6100 involves a use-after-free condition in decompression modules that could allow arbitrary code execution or information disclosure. CVE-2026-4786 involves arbitrary code execution through command injection in the webbrowser.open() API. Red Hat has released updated python3.9 packages that fix these vulnerabilities. The advisory references Red Hat Bugzilla entries BZ-2457932 and BZ-2458049 for the respective CVEs. No CVSS scores are provided in the advisory, but the impact is rated as important by Red Hat Product Security.

Successful exploitation of CVE-2026-6100 could allow an attacker to execute arbitrary code or disclose sensitive information due to a use-after-free vulnerability in decompression modules. CVE-2026-4786 could allow arbitrary code execution via command injection in the webbrowser.open() API. Both vulnerabilities pose a significant risk to affected systems running vulnerable versions of python3.9 on Red Hat Enterprise Linux 9.2.

Red Hat has released updated python3.9 packages for Red Hat Enterprise Linux 9.2 that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2026:19570 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated by the vendor advisory.