PT-2026-47453 · Python · Cpython

Bitshift + 3 · Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-9669

Mitre

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.

Fix

Stack Overflow

Weakness Enumeration

CWE-121

Related Identifiers

CVE-2026-9669

Affected Products

Cpython

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-9669 · Security Note
• https://mail.python.org/archives/list/[e-mail]/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX · Vendor Advisory
• https://github.com/python/cpython/pull/150600 · Patch
• https://github.com/python/cpython/issues/150599 · Note