bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow
Summary
| CVE | CVE-2026-9669 |
|---|---|
| State | PUBLISHED |
| Assigner | PSF |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-06-08 23:17:25 UTC |
| Updated | 2026-07-07 18:16:40 UTC |
| Description | bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data. |
Risk And Classification
Primary CVSS: v4.0 8.2 HIGH from [email protected]
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS: 0.004330000 probability, percentile 0.348900000 (date 2026-07-09)
Problem Types: CWE-121 | CWE-121 CWE-121 Stack-based buffer overflow
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 4.0 | [email protected] | Secondary | 8.2 | HIGH | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/C... |
| 4.0 | CNA | CVSS | 8.2 | HIGH | CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
CVSS v4.0 Breakdown
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Python Software Foundation | CPython | affected 3.13.14 python | Not specified |
| CNA | Python Software Foundation | CPython | affected 3.14.0 3.14.6 python | Not specified |
| CNA | Python Software Foundation | CPython | affected 3.15.0a1 3.15.0b3 python | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79 | [email protected] | github.com | |
| www.openwall.com/lists/oss-security/2026/06/08/17 | af854a3a-2127-422b-91ae-364da2661108 | www.openwall.com | |
| github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6 | [email protected] | github.com | |
| github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e | [email protected] | github.com | |
| github.com/python/cpython/pull/150600 | [email protected] | github.com | |
| github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f | [email protected] | github.com | |
| github.com/python/cpython/issues/150599 | [email protected] | github.com | |
| github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d | [email protected] | github.com | |
| mail.python.org/archives/list/[email protected]/thread/DBJZETMGUIF... | [email protected] | mail.python.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
Vendor Comments And Credit
Discovery Credit
CNA: Bitshift (https://github.com/TheShiftedBit) (en)
CNA: Emma Smith (https://github.com/emmatyping) (en)
CNA: Stan Ulbrych (https://github.com/StanFromIreland) (en)
CNA: Serhiy Storchaka (https://github.com/serhiy-storchaka) (en)