CVE-2026-6100

OVERVIEW CVE-2026-6100 is a use-after-free vulnerability in Python's compression modules (lzma.LZMADecompressor, bz2.BZ2Decompressor, and gzip.GzipFile) that occurs when memory allocation fails during decompression and the decompressor instance is subsequently reused. The vulnerability manifests when a MemoryError is raised in a memory-constrained environment and the same decompressor object is leveraged for additional decompression operations, leaving a dangling pointer that can be exploited. The vulnerability does not affect one-shot decompression helper functions or instances that are not reused after error conditions. SEVERITY While a complete CVSS score is not available, the vulnerability is characterized as a use-after-free condition that is theoretically exploitable. The attack requires specific conditions: an application must reuse decompressor instances across multiple calls, encounter a MemoryError during decompression, and then attempt further decompression operations. The EPSS score of 0.0015 indicates an exceptionally low probability of exploitation in the wild, placing it in the lowest percentile of vulnerabilities. The FAUCET Risk Score of 53/100 suggests moderate concern from a risk management perspective. EXPLOITATION STATUS There is no evidence of active exploitation. The vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog, and it is not currently listed on any vulnerability hot list. Exploitation requires highly specific application behavior (reusing decompressor instances after encountering memory errors), which is not a common coding pattern, significantly limiting the practical attack surface in real-world deployments.