PT-2026-47453 · Python+1 · Python+1

Bitshift + 3 · CVE-2026-9669 · Published 2026-06-08 · Updated 2026-07-23

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Python (affected versions not specified)

Description bz2.BZ2Decompressor objects can be reused following a decompression error. If an application catches the resulting OSError and attempts to retry using the same decompressor, specially crafted input may cause the decompressor to resume from an invalid internal state. This leads to out-of-bounds writes to a stack buffer, which can result in a process crash when processing untrusted data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

BIT-LIBPYTHON-2026-9669

BIT-PYTHON-2026-9669

BIT-PYTHON-MIN-2026-9669

CVE-2026-9669

ECHO-19F0-B298-0F29

OESA-2026-2694

OESA-2026-2695

OPENSUSE-SU-2026:11181-1

PSF-2026-27

USN-8509-1

Affected Products

Linuxmint

Python

References · 68

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9669.json · Exploit
• https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79 · Patch
• https://github.com/python/cpython/pull/150600 · Patch
• https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d · Patch
• https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e · Patch
• https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f · Patch
• https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6 · Patch
• https://osv.dev/vulnerability/PSF-2026-27 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-python-2026-9669 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-2297 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-3644 · Vendor Advisory
• https://osv.dev/vulnerability/USN-8509-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-9669 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-9669 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-9669 · Vendor Advisory