Every CVE Search/ Get API key

CVE-2026-42250

Off-by-One Leading to Out-of-Bounds Write in bzip2

4.8 MediumFix available

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).

This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.13%Up 0.1 points since May 29, 2026
90%50%10%1%

What each source reports

CVE List Score used 4.8

Off-by-One Leading to Out-of-Bounds Write in bzip2

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).

This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67

Record
CVE-2026-42250
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-787
Updated
2026-11-02
EUVDEUVD-2026-32898 4.8

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).

This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67

Record
EUVD-2026-32898
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-9r29-3vrx-4537 5.1

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially...

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).

This issue was fixed in bzip2 version 1.0.9

Record
GHSA-9r29-3vrx-4537
CVSS 4.0
5.1 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-787
Updated
2026-11-02
NVD 4.8

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).

This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67

Record
CVE-2026-42250
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-787
Updated
2026-11-02
OSVDEBIAN-CVE-2026-42250 4.8

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67

Record
DEBIAN-CVE-2026-42250
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
OSVOESA-2026-2786 4.8

bzip2 security update

bzip2 is a freely available, patent free, high-quality data compressor. It typically compresses files to within 10% to 15% of the best available techniques (the PPM family of statistical compressors), whilst being around twice as fast at compression and six times faster at decompression.

Security Fix(es):

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).

This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67(CVE-2026-42250)

Record
OESA-2026-2786
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
Show 19 moreShow less
OSVRHSA-2026:30268 5.0

Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

Record
RHSA-2026:30268
CVSS 3.1
5.0 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2026-42250 4.8

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67

Record
UBUNTU-CVE-2026-42250
CVSS 4.0
4.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVAZL-88809 No score

CVE-2026-42250 affecting package bzip2 for versions less than 1.0.8-2

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).

This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67

Record
AZL-88809
Updated
2026-11-05
OSVAZL-89190 No score

CVE-2026-42250 affecting package kata-containers-cc for versions less than 3.15.0.aks0-15

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).

This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67

Record
AZL-89190
Updated
2026-11-05
OSVCLSA-2026-1788430930 No score

Fix CVE(s): CVE-2026-42250

  • SECURITY UPDATE: out-of-bounds read and write in bzip2recover when a .bz2 file yields more than BZ_MAX_HANDLED_BLOCKS block boundaries (ELSCVE-178967)
    • debian/patches/CVE-2026-42250.patch: correct the off-by-one in the block-count guard in bzip2recover.c, so the scanning loop stops one block earlier instead of indexing one past bStart, bEnd, rbStart and rbEnd.
    • CVE-2026-42250
Record
CLSA-2026-1788430930
Updated
2026-11-02
OSVCLSA-2026-1788815685 No score

Fix CVE(s): CVE-2026-42250

  • SECURITY UPDATE: out-of-bounds read and write in bzip2recover when a .bz2 file yields more than BZ_MAX_HANDLED_BLOCKS block boundaries (ELSCVE-178964)
    • debian/patches/CVE-2026-42250.patch: correct the off-by-one in the block-count guard in bzip2recover.c, so the scanning loop stops one block earlier instead of indexing one past bStart, bEnd, rbStart and rbEnd.
    • CVE-2026-42250
Record
CLSA-2026-1788815685
Updated
2026-11-02
OSVMGASA-2026-0403 No score

Updated bzip2 packages fix a security vulnerability

Off-by-One Leading to Out-of-Bounds Write in bzip2. (CVE-2026-42250

Record
MGASA-2026-0403
Updated
2026-11-02
OSVopenSUSE-SU-2026:11627-1 No score

bzip2-1.0.8-6.1 on GA media

These are all security issues fixed in the bzip2-1.0.8-6.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11627-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:21762-1 No score

Security update for bzip2

This update for bzip2 fixes the following issue:

  • CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a crash (bsc#1266786).
Record
openSUSE-SU-2026:21762-1
Updated
2026-11-02
OSVROOT-OS-DEBIAN-11-CVE-2026-42250 No score

CVE-2026-42250 in bzip2 - Patched by Root

Root has patched CVE-2026-42250 in the bzip2 package for Root:Debian:11. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-11-CVE-2026-42250
Updated
2026-11-02
OSVROOT-OS-DEBIAN-12-CVE-2026-42250 No score

CVE-2026-42250 in bzip2 - Patched by Root

Root has patched CVE-2026-42250 in the bzip2 package for Root:Debian:12. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-12-CVE-2026-42250
Updated
2026-11-02
OSVROOT-OS-DEBIAN-13-CVE-2026-42250 No score

CVE-2026-42250 in bzip2 - Patched by Root

Root has patched CVE-2026-42250 in the bzip2 package for Root:Debian:13. Multiple fixed versions available.

Record
ROOT-OS-DEBIAN-13-CVE-2026-42250
Updated
2026-11-02
OSVSUSE-SU-2026:23415-1 No score

Security update for bzip2

This update for bzip2 fixes the following issue:

  • CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a crash (bsc#1266786).
Record
SUSE-SU-2026:23415-1
Updated
2026-11-02
OSVSUSE-SU-2026:23442-1 No score

Security update for bzip2

This update for bzip2 fixes the following issue:

  • CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a crash (bsc#1266786).
Record
SUSE-SU-2026:23442-1
Updated
2026-11-02
OSVSUSE-SU-2026:23494-1 No score

Security update for bzip2

This update for bzip2 fixes the following issue:

  • CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a crash (bsc#1266786).
Record
SUSE-SU-2026:23494-1
Updated
2026-11-02
OSVSUSE-SU-2026:23627-1 No score

Security update for bzip2

This update for bzip2 fixes the following issue:

  • CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a crash (bsc#1266786).
Record
SUSE-SU-2026:23627-1
Updated
2026-11-02
OSVSUSE-SU-2026:3925-1 No score

Security update for bzip2

This update for bzip2 fixes the following issue:

  • CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a crash (bsc#1266786).
Record
SUSE-SU-2026:3925-1
Updated
2026-11-02
OSVSUSE-SU-2026:4055-1 No score

Security update for bzip2

This update for bzip2 fixes the following issue:

  • CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a crash (bsc#1266786).
Record
SUSE-SU-2026:4055-1
Updated
2026-11-02
OSVUSN-8685-1 No score

bzip2 vulnerability

It was discovered that bzip2 did not properly manage memory under certain circumstances. An attacker could possibly use this issue to cause a crash, resulting in a denial of service.

Record
USN-8685-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
bzip2
Azure Linux:3
 before 1.0.8-2
1.0.8-2
kata-containers-cc
Azure Linux:3
 before 3.15.0.aks0-15
3.15.0.aks0-15
bzip2
Alpaquita:23
 1.0.8-r4 up to 1.0.8-r5
1.0.8-r5
bzip2
Alpaquita:25
 1.0.8-r6 up to 1.0.8-r7
1.0.8-r7
bzip2
Alpaquita:stream
 1.0.8-r3 up to 1.0.8-r7
1.0.8-r7
bzip2
BellSoft Hardened Containers:23
 1.0.8-r4 up to 1.0.8-r5
1.0.8-r5
bzip2
BellSoft Hardened Containers:25
 1.0.8-r6 up to 1.0.8-r7
1.0.8-r7
bzip2
BellSoft Hardened Containers:stream
 1.0.8-r3 up to 1.0.8-r7
1.0.8-r7
bzip2
TuxCare:Ubuntu:18.04
 before 1.0.6-8.1ubuntu0.2+tuxcare.els1
1.0.6-8.1ubuntu0.2+tuxcare.els1
bzip2-doc
TuxCare:Ubuntu:18.04
 before 1.0.6-8.1ubuntu0.2+tuxcare.els1
1.0.6-8.1ubuntu0.2+tuxcare.els1
Show 46 moreShow less
Affected packages
PackageAffectedFixed
libbz2-1.0
TuxCare:Ubuntu:18.04
 before 1.0.6-8.1ubuntu0.2+tuxcare.els1
1.0.6-8.1ubuntu0.2+tuxcare.els1
libbz2-dev
TuxCare:Ubuntu:18.04
 before 1.0.6-8.1ubuntu0.2+tuxcare.els1
1.0.6-8.1ubuntu0.2+tuxcare.els1
bzip2
TuxCare:Ubuntu:16.04
 before 1.0.6-8ubuntu0.2+tuxcare.els1
1.0.6-8ubuntu0.2+tuxcare.els1
bzip2-doc
TuxCare:Ubuntu:16.04
 before 1.0.6-8ubuntu0.2+tuxcare.els1
1.0.6-8ubuntu0.2+tuxcare.els1
libbz2-1.0
TuxCare:Ubuntu:16.04
 before 1.0.6-8ubuntu0.2+tuxcare.els1
1.0.6-8ubuntu0.2+tuxcare.els1
libbz2-dev
TuxCare:Ubuntu:16.04
 before 1.0.6-8ubuntu0.2+tuxcare.els1
1.0.6-8ubuntu0.2+tuxcare.els1
bzip2
Debian:12
 All versions, plus listed versions
1.0.8-51.0.8-5.11.0.8-6
 None known
bzip2
Debian:13
 All versions, plus listed versions
1.0.8-6
 None known
bzip2
Debian:14
 All versions, plus listed versions
1.0.8-6
 None known
bzip2
Mageia:10
 before 1.0.8-7.1.mga10
1.0.8-7.1.mga10
bzip2
Mageia:9
 before 1.0.8-5.1.mga9
1.0.8-5.1.mga9
bzip2
openEuler:24.03-LTS-SP1
 before 1.0.8-9.oe2403sp1
1.0.8-9.oe2403sp1
bzip2
openEuler:24.03-LTS-SP3
 before 1.0.8-9.oe2403sp3
1.0.8-9.oe2403sp3
bzip2
openEuler:20.03-LTS-SP4
 before 1.0.8-7.oe2003sp4
1.0.8-7.oe2003sp4
bzip2
openEuler:22.03-LTS-SP4
 before 1.0.8-7.oe2203sp4
1.0.8-7.oe2203sp4
bzip2
Red Hat:hummingbird:1
 before 0:1.0.8-23.2.hum1
0:1.0.8-23.2.hum1
bzip2-devel
Red Hat:hummingbird:1
 before 0:1.0.8-23.2.hum1
0:1.0.8-23.2.hum1
bzip2-libs
Red Hat:hummingbird:1
 before 0:1.0.8-23.2.hum1
0:1.0.8-23.2.hum1
bzip2-static
Red Hat:hummingbird:1
 before 0:1.0.8-23.2.hum1
0:1.0.8-23.2.hum1
bzip2
Root:Debian:11
 before 1.0.8-4.aikido.2
1.0.8-4.aikido.21.0.8-4.root.io.1
rootio-bzip2
Root:Debian:11
 before 1.0.8-4.aikido.2
1.0.8-4.aikido.21.0.8-4.root.io.1
bzip2
Root:Debian:12
 before 1.0.8-5.aikido.4
1.0.8-5.aikido.41.0.8-5.aikido.21.0.8-5.aikido.31.0.8-5.root.io.1
rootio-bzip2
Root:Debian:12
 before 1.0.8-5.aikido.4
1.0.8-5.aikido.41.0.8-5.aikido.21.0.8-5.aikido.31.0.8-5.root.io.1
bzip2
Root:Debian:13
 before 1.0.8-6.aikido.2
1.0.8-6.aikido.21.0.8-6.root.io.1
rootio-bzip2
Root:Debian:13
 before 1.0.8-6.aikido.2
1.0.8-6.aikido.21.0.8-6.root.io.1
bzip2
SUSE:Linux Micro 6.1
 before 1.0.8-slfo.1.1_2.1
1.0.8-slfo.1.1_2.1
bzip2
SUSE:Linux Micro 6.0
 before 1.0.8-4.1
1.0.8-4.1
bzip2
SUSE:Linux Micro 6.2
 before 1.0.8-160000.3.1
1.0.8-160000.3.1
bzip2
SUSE:Linux Enterprise Server 16.0
 before 1.0.8-160000.3.1
1.0.8-160000.3.1
bzip2
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 1.0.8-160000.3.1
1.0.8-160000.3.1
bzip2
SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5
 before 1.0.6-30.17.1
1.0.6-30.17.1
bzip2
SUSE:Linux Enterprise Micro 5.3
 before 1.0.8-150400.3.4.1
1.0.8-150400.3.4.1
bzip2
SUSE:Linux Enterprise Micro 5.4
 before 1.0.8-150400.3.4.1
1.0.8-150400.3.4.1
bzip2
SUSE:Linux Enterprise Micro 5.5
 before 1.0.8-150400.3.4.1
1.0.8-150400.3.4.1
bzip2
SUSE:Linux Enterprise Module for Basesystem 15 SP7
 before 1.0.8-150400.3.4.1
1.0.8-150400.3.4.1
bzip2
Ubuntu:Pro:14.04:LTS
 before 1.0.6-5ubuntu0.1~esm3, plus listed versions
1.0.6-41.0.6-51.0.6-5ubuntu0.1~esm11.0.6-5ubuntu0.1~esm2
1.0.6-5ubuntu0.1~esm3
bzip2
Ubuntu:Pro:16.04:LTS
 before 1.0.6-8ubuntu0.2+esm1, plus listed versions
1.0.6-81.0.6-8ubuntu0.11.0.6-8ubuntu0.2
1.0.6-8ubuntu0.2+esm1
bzip2
Ubuntu:Pro:18.04:LTS
 before 1.0.6-8.1ubuntu0.2+esm1, plus listed versions
1.0.6-8.11.0.6-8.1ubuntu0.11.0.6-8.1ubuntu0.2
1.0.6-8.1ubuntu0.2+esm1
bzip2
Ubuntu:Pro:20.04:LTS
 before 1.0.8-2ubuntu0.1~esm1, plus listed versions
1.0.6-9.21.0.8-2
1.0.8-2ubuntu0.1~esm1
bzip2
Ubuntu:22.04:LTS
 before 1.0.8-5ubuntu0.1, plus listed versions
1.0.8-4ubuntu31.0.8-4ubuntu41.0.8-51.0.8-5build1
1.0.8-5ubuntu0.1
bzip2
Ubuntu:24.04:LTS
 before 1.0.8-5.1ubuntu0.1, plus listed versions
1.0.8-5build11.0.8-5ubuntu11.0.8-5.11.0.8-5.1build0.1
1.0.8-5.1ubuntu0.1
bzip2
Ubuntu:25.10
 All versions, plus listed versions
1.0.8-61.0.8-6build1
 None known
bzip2
Ubuntu:26.10
 All versions, plus listed versions
1.0.8-6build2
 None known
bzip2
Ubuntu:26.04:LTS
 before 1.0.8-6ubuntu0.1, plus listed versions
1.0.8-6build11.0.8-6build2
1.0.8-6ubuntu0.1
bzip2
openSUSE:Tumbleweed
 before 1.0.8-6.1
1.0.8-6.1
bzip2
openSUSE:Leap 16.0
 before 1.0.8-160000.3.1
1.0.8-160000.3.1

History

History
RecordedChangedSources
factsOSV
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-42250 is a medium vulnerability (CVSS 4.8) in Bzip2, published May 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.13%, the 2nd percentile. Fixed in bzip2 1.0.8-2.

References

Show 25 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open