CVE-2026-9669
If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer.
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (0.68%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.
- CVSS 4.0
- 8.2 HIGHCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/M
- EPSS
- 0.68% probability · 50th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-121
- Source
- cna@python.org
References
- https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6
- https://github.com/python/cpython/commit/1ba6135eae75ad8413413caeeedb56ae72320636
- https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e
- https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f
- https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79
- https://github.com/python/cpython/commit/991e6cf86496718c4ef00b362d640e00cb5c85b2
- https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d
- https://github.com/python/cpython/issues/150599
- https://github.com/python/cpython/pull/150600
- https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/
- http://www.openwall.com/lists/oss-security/2026/06/08/17
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.