CVE-2026-9669CWE-121

CVE-2026-9669

published June 9, 2026

CVSS

8.2

EPSS

0%

Percentile

36.0

In the wild

Unconfirmed

What it is

bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.

The record

Technical detail

CVSS: 8.2 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00428 · 36.0th percentile
Weakness: CWE-121 · Stack-based Buffer Overflow
Published: 2026-06-09T03:17Z

References (11)

https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6 · [email protected]https://github.com/python/cpython/commit/1ba6135eae75ad8413413caeeedb56ae72320636 · [email protected]https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e · [email protected]https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f · [email protected]https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79 · [email protected]https://github.com/python/cpython/commit/991e6cf86496718c4ef00b362d640e00cb5c85b2 · [email protected]https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d · [email protected]https://github.com/python/cpython/issues/150599 · [email protected]https://github.com/python/cpython/pull/150600 · [email protected]https://mail.python.org/archives/list/[email protected]/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/ · [email protected]http://www.openwall.com/lists/oss-security/2026/06/08/17 · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

08 JUN 22:01Z
bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow
cvelistv5