CVE-2026-9669: bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.
Other sources
bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/python3.13to a version that resolves this vulnerability.Fixed in 3.13.14-1 - Upgrade
Upgrade
debian/python3.14to a version that resolves this vulnerability.Fixed in 3.14.6-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.12.9-14 - Upgrade
Upgrade
CPython bz2.BZ2Decompressorto a version that resolves this vulnerability.Patch CVE-2026-9669
Event History
Frequently Asked Questions
What is the severity of CVE-2026-9669?
CVE-2026-9669 has a high severity rating of 8.2 according to the CVSS.
What type of vulnerability is described in CVE-2026-9669?
CVE-2026-9669 describes a stack buffer overflow vulnerability in the bz2.BZ2Decompressor due to object reuse after a decompression error.
How do I fix CVE-2026-9669?
To fix CVE-2026-9669, ensure you are using an updated version of the Python CPython bz2 module that has addressed this vulnerability.
What can be impacted by CVE-2026-9669?
CVE-2026-9669 can potentially impact applications using the bz2.BZ2Decompressor if they handle decompression errors poorly.
Is CVE-2026-9669 being actively exploited?
As of now, there are no known instances of CVE-2026-9669 being actively exploited in the wild.