The vulnerability (CVE-2026-11940) affects the tarfile.extractall() function in the Python standard library shipped with Red Hat Hardened Images. An attacker can craft an archive that uses a hardlink pointing to a symlink to escape the extraction directory, resulting in out-of-destination file reads or writes. This can lead to information disclosure or arbitrary file modification. The advisory clarifies that other similarly named packages are not affected. Red Hat has issued updated python3.11 RPMs (version 3.11.15-5.2.hum1) for aarch64 and x86_64 architectures to fix this issue. No effective mitigation other than applying the update is currently available according to Red Hat Product Security.

Successful exploitation can allow an attacker to read or write files outside the intended extraction directory, potentially leading to information disclosure or arbitrary modification of critical files. This could compromise confidentiality and integrity of the system. There is no impact on availability reported. The vulnerability requires low privileges and low attack complexity but user interaction is required to trigger extraction of the malicious archive.

Red Hat has released updated python3.11 RPM packages (3.11.15-5.2.hum1) that fix this vulnerability. Users should apply these updates to mitigate the issue. Currently, no other mitigation options meet Red Hat's criteria for ease of use, applicability, or stability. Therefore, applying the official update is the recommended remediation.