Executive brief
A vulnerability in Python's standard library could allow an attacker to cause a system crash or potentially execute unauthorized code when the system is under heavy memory pressure. This occurs when specific data decompression tools (LZMA, BZ2, and Gzip) are reused after a memory failure, leading to the use of corrupted memory pointers. Applications that decompress untrusted data and reuse decompression objects are at the highest risk.
Technical details
A use-after-free (UAF) vulnerability exists in Python's `lzma.LZMADecompressor`, `bz2.BZ2Decompressor`, and `zlib._ZlibDecompressor` classes. The flaw is triggered when a memory allocation fails (raising a `MemoryError`) during a decompression operation, leaving a dangling pointer in the decompressor instance. If the same instance is subsequently reused for another decompression call, the process may read or write through this stale pointer. This can lead to arbitrary code execution or a denial-of-service (crash). The vulnerability is only exploitable if the application catches the `MemoryError` and continues to use the same decompressor object; one-shot helper functions like `lzma.decompress()` are not affected.
Affected products
- Python Software Foundation CPython 3.10, 3.11, 3.13, 3.14
Timeline
- 2026-04-13: advisory: Initial disclosure and NVD publication
- 2026-04-13: disclosed: Public disclosure via oss-security list
References
- https://github.com/python/cpython/commit/47128e64f98c3a20271138a98c2922bea2a3ee0e
- https://github.com/python/cpython/commit/6a5f79c8d7bbf22b083b240910c7a8781a59437d
- https://github.com/python/cpython/commit/8fc66aef6d7b3ae58f43f5c66f9366cc8cbbfcd2
- https://github.com/python/cpython/commit/c3cf71c3366fe49acb776a639405c0eea6169c20
- https://github.com/python/cpython/commit/e20c6c9667c99ecaab96e1a2b3767082841ffc8b
- https://github.com/python/cpython/issues/148395
- https://github.com/python/cpython/pull/148396