A use‑after‑free flaw exists in CPython’s LZMA, BZ2, and Gzip decompression classes. When a decompression call raises a MemoryError and the same decompressor instance is reused, the implementation may access freed memory. This can corrupt memory and in the worst case allow an attacker to execute arbitrary code through controlled data.

Python Software Foundation’s CPython is affected whenever a decompressor object is reused after a MemoryError. The flaw applies to all releases that contain the vulnerable decompressors and have not yet incorporated the patches found in the commits referenced in the CVE advisory. No specific version list is provided, so all pre‑patch CPython releases are considered vulnerable.

The vulnerability carries a CVSS score of 9.1, indicating a high‑severity risk. Exploitation requires the target process to be under memory pressure and to reuse a decompressor instance after encountering a MemoryError, a scenario that is realistic for long‑running services that handle compressed data. EPSS data is not available, and the issue is not listed in the CISA KEV catalog, but the high severity and the nature of the flaw suggest a substantial likelihood of exploitation if an attacker can trigger the conditions from within the application process.