PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Finding and Patching a CPython 0day in Hours: CVE-2026-6100

theori.io | vulnerability | Critical | CVE-2026-6100 | #ai-security | #zero-day | #use-after-free | #patch | #cpython | #cve-2026-6100 | #tarfile
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

CVE-2026-6100 timeline: Xint Code flagged a critical CPython tarfile flaw within 30 minutes, and Python maintainers patched three compression modules the day after the report.
CVE
CVE-2026-6100
CVSS
9.1
Published
Collected

Related coverage

vulnerability · theori.io
Deep Dive into RCU Race Condition: Analysis of TCP-AO UAF (CVE-2024–27394)
A deep dive into CVE-2024-27394, a TCP-AO use-after-free caused by incorrect RCU API usage in the Linux kernel, covering RCU internals, the patch, and the ExpRace technique for reliable triggering.
vulnerability · theori.io
Chaining N-days to Compromise All: Part 2 — Windows Kernel LPE (a.k.a Chrome Sandbox Escape)
Part two of the chain: how CVE-2023-21674, a use-after-free in the Windows NT kernel involving ALPC, was exploited to escape the Chrome sandbox — the year’s first in-the-wild kernel bug.
vulnerability · theori.io
Linux Kernel Exploit (CVE-2022–32250) with mqueue
Exploiting CVE-2022-32250, a Netfilter nftables use-after-free write, to root Ubuntu 22.04: heap and KASLR leaks with mqueue, a modprobe_path overwrite, plus root-cause analysis and patch.
High · vulnerability · blog.quarkslab.com
PageJack in Action: CVE-2022-0995 exploit
Quarkslab applies PageJack, a 2024 page-allocator exploitation technique, to CVE-2022-0995 — an out-of-bounds write in the Linux kernel's watch_queue affecting 5.17+ — with a full working exploit.
High · vulnerability · swarm.ptsecurity.com
Kernel-hack-drill and a new approach to exploiting CVE-2024-50264 in the Linux kernel
Alexander Popov presents kernel-hack-drill, the tooling that helped him exploit CVE-2024-50264, a race-condition use-after-free in the Linux kernel's AF_VSOCK (Pwnie 2025, Best Privilege Escalation).
vulnerability · blog.quarkslab.com
Exploiting MS16-145: MS Edge TypedArray.sort Use-After-Free (CVE-2016-7288)
Exploiting CVE-2016-7288, a use-after-free in MS Edge's TypedArray.sort: root cause analysis, reliable triggering, abusing Quicksort and WebGL for read/write primitives, and a CFG bypass with COOP.
Back