---
id: CVE-2026-9669
title: bz2.BZ2Decompressor objects could be reused after a decompression error
summary: >-
  bz2.BZ2Decompressor objects could be reused after a decompression error. If an
  application caught the resulting OSError and retried with the same
  decompressor, crafted input could cause the decompressor to resume from an
  invalid internal…
severity: medium
cwe:
  - CWE-121
  - CWE-787
published: '2026-06-08'
updated: '2026-07-07'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-9669'
references:
  - url: >-
      https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79
    label: cna@python.org
  - url: >-
      https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d
    label: cna@python.org
  - url: 'https://github.com/python/cpython/issues/150599'
    label: cna@python.org
  - url: 'https://github.com/python/cpython/pull/150600'
    label: cna@python.org
  - url: >-
      https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/
    label: cna@python.org
  - url: 'http://www.openwall.com/lists/oss-security/2026/06/08/17'
    label: af854a3a-2127-422b-91ae-364da2661108
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9669.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-9669'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2486590'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-9669'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-9669'
  - url: 'https://access.redhat.com/errata/RHSA-2026:67572'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68132'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68135'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68154'
  - url: 'https://access.redhat.com/errata/RHSA-2026:68309'
tags:
  - nvd
  - csaf
  - vex
  - red-hat
epss: 0.0068
epssPercentile: 0.50982
ingestedAt: '2026-07-08T12:51:00.732Z'
vendor: Red Hat
product: Red Hat Enterprise Linux 8
affected:
  - enterprise_linux 8
  - hardened_images
cvss: 5.9
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'
cvssSource: vendor
patched:
  - hardened_images
---

## Overview

bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Vendor advisories

- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 8 · no fix planned: Red Hat Enterprise Linux 8 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9669.json)
- **RHSA-2026:67572** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-15 · [advisory](https://access.redhat.com/errata/RHSA-2026:67572)
- **RHSA-2026:68132** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68132)
- **RHSA-2026:68135** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68135)
- **RHSA-2026:68154** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68154)
- **RHSA-2026:68309** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-09-16 · [advisory](https://access.redhat.com/errata/RHSA-2026:68309)