CVE-2026-9669
8.2
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Summary
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Python Software Foundation | CPython | 0 < 3.13.14 | affected |
| Python Software Foundation | CPython | 3.14.0 < 3.14.6 | affected |
| Python Software Foundation | CPython | 3.15.0a1 < 3.15.0b3 | affected |
Weaknesses
- CWE-121: CWE-121 Stack-based buffer overflow
ADP Enrichment
CVE Program Container
Additional References
CISA ADP Vulnrichment
- SSVC:
- Exploitation: none
- Automatable: no
- Technical Impact: partial
References
- https://github.com/python/cpython/pull/150600
- https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/
- https://github.com/python/cpython/issues/150599
- https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6
- https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e
- https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f
- https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.