CVE-2026-9669

HIGH

CPython bz2.BZ2Decompressor - Stack Buffer Overflow

Title source: manual
STIX 2.1

Description

bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.

References (10)

Core 10
Core References
Issue Tracking issue-tracking
https://github.com/python/cpython/issues/150599

Scores

CVSS v4 8.2
EPSS 0.0042
EPSS Percentile 34.3%
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-121
Status published
Products (5)
Python Software Foundation/CPython < 3.13.14
Python Software Foundation/CPython < 3.16.0
Python Software Foundation/CPython 3.14.0 - 3.14.6
Python Software Foundation/CPython 3.15.0a1 - 3.15.0
Python Software Foundation/CPython 3.15.0a1 - 3.15.0b3
Published Jun 08, 2026
Tracked Since Jun 09, 2026