{"id":"CVE-2026-42250","aliases":["AZL-88809","AZL-89190","BELL-CVE-2026-42250","CLSA-2026-1788430930","CLSA-2026-1788815685","DEBIAN-CVE-2026-42250","EUVD-2026-32898","GHSA-9r29-3vrx-4537","MGASA-2026-0403","OESA-2026-2786","RHSA-2026:30268","ROOT-OS-DEBIAN-11-CVE-2026-42250","ROOT-OS-DEBIAN-12-CVE-2026-42250","ROOT-OS-DEBIAN-13-CVE-2026-42250","SUSE-SU-2026:23415-1","SUSE-SU-2026:23442-1","SUSE-SU-2026:23494-1","SUSE-SU-2026:23627-1","SUSE-SU-2026:3925-1","SUSE-SU-2026:4055-1","UBUNTU-CVE-2026-42250","USN-8685-1","openSUSE-SU-2026:11627-1","openSUSE-SU-2026:21762-1"],"status":"published","title":"Off-by-One Leading to Out-of-Bounds Write in bzip2","description":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67","severity":{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00126,"percentile":0.02346,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-787"],"published":"2026-05-28T13:15:19Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"Azure Linux:3","package":"bzip2","fixed_in":["1.0.8-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kata-containers-cc","fixed_in":["3.15.0.aks0-15"],"sources":["osv"]},{"ecosystem":"Alpaquita:23","package":"bzip2","fixed_in":["1.0.8-r5"],"sources":["osv"]},{"ecosystem":"Alpaquita:25","package":"bzip2","fixed_in":["1.0.8-r7"],"sources":["osv"]},{"ecosystem":"Alpaquita:stream","package":"bzip2","fixed_in":["1.0.8-r7"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:23","package":"bzip2","fixed_in":["1.0.8-r5"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:25","package":"bzip2","fixed_in":["1.0.8-r7"],"sources":["osv"]},{"ecosystem":"BellSoft Hardened Containers:stream","package":"bzip2","fixed_in":["1.0.8-r7"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"bzip2","fixed_in":["1.0.6-8.1ubuntu0.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"bzip2-doc","fixed_in":["1.0.6-8.1ubuntu0.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libbz2-1.0","fixed_in":["1.0.6-8.1ubuntu0.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:18.04","package":"libbz2-dev","fixed_in":["1.0.6-8.1ubuntu0.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"bzip2","fixed_in":["1.0.6-8ubuntu0.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"bzip2-doc","fixed_in":["1.0.6-8ubuntu0.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libbz2-1.0","fixed_in":["1.0.6-8ubuntu0.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"TuxCare:Ubuntu:16.04","package":"libbz2-dev","fixed_in":["1.0.6-8ubuntu0.2+tuxcare.els1"],"sources":["osv"]},{"ecosystem":"Mageia:10","package":"bzip2","fixed_in":["1.0.8-7.1.mga10"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"bzip2","fixed_in":["1.0.8-5.1.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"bzip2","fixed_in":["1.0.8-9.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP3","package":"bzip2","fixed_in":["1.0.8-9.oe2403sp3"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"bzip2","fixed_in":["1.0.8-7.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"bzip2","fixed_in":["1.0.8-7.oe2203sp4"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"bzip2","fixed_in":["0:1.0.8-23.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"bzip2-devel","fixed_in":["0:1.0.8-23.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"bzip2-libs","fixed_in":["0:1.0.8-23.2.hum1"],"sources":["osv"]},{"ecosystem":"Red Hat:hummingbird:1","package":"bzip2-static","fixed_in":["0:1.0.8-23.2.hum1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"bzip2","fixed_in":["1.0.8-4.aikido.2","1.0.8-4.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:11","package":"rootio-bzip2","fixed_in":["1.0.8-4.aikido.2","1.0.8-4.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"bzip2","fixed_in":["1.0.8-5.aikido.4","1.0.8-5.aikido.2","1.0.8-5.aikido.3","1.0.8-5.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:12","package":"rootio-bzip2","fixed_in":["1.0.8-5.aikido.4","1.0.8-5.aikido.2","1.0.8-5.aikido.3","1.0.8-5.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"bzip2","fixed_in":["1.0.8-6.aikido.2","1.0.8-6.root.io.1"],"sources":["osv"]},{"ecosystem":"Root:Debian:13","package":"rootio-bzip2","fixed_in":["1.0.8-6.aikido.2","1.0.8-6.root.io.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"bzip2","fixed_in":["1.0.8-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"bzip2","fixed_in":["1.0.8-4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.2","package":"bzip2","fixed_in":["1.0.8-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"bzip2","fixed_in":["1.0.8-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"bzip2","fixed_in":["1.0.8-160000.3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"bzip2","fixed_in":["1.0.6-30.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"bzip2","fixed_in":["1.0.8-150400.3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"bzip2","fixed_in":["1.0.8-150400.3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"bzip2","fixed_in":["1.0.8-150400.3.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"bzip2","fixed_in":["1.0.8-150400.3.4.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"bzip2","fixed_in":["1.0.6-5ubuntu0.1~esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bzip2","fixed_in":["1.0.6-8ubuntu0.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bzip2","fixed_in":["1.0.6-8.1ubuntu0.2+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bzip2","fixed_in":["1.0.8-2ubuntu0.1~esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"bzip2","fixed_in":["1.0.8-5ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"bzip2","fixed_in":["1.0.8-5.1ubuntu0.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:26.04:LTS","package":"bzip2","fixed_in":["1.0.8-6ubuntu0.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"bzip2","fixed_in":["1.0.8-6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 16.0","package":"bzip2","fixed_in":["1.0.8-160000.3.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Azure Linux:3","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers-cc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.15.0.aks0-15"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.8-r4"},{"fixed":"1.0.8-r5"}]}]},{"source":"osv","ecosystem":"Alpaquita:25","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.8-r6"},{"fixed":"1.0.8-r7"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.8-r3"},{"fixed":"1.0.8-r7"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:23","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.8-r4"},{"fixed":"1.0.8-r5"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:25","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.8-r6"},{"fixed":"1.0.8-r7"}]}]},{"source":"osv","ecosystem":"BellSoft Hardened Containers:stream","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.8-r3"},{"fixed":"1.0.8-r7"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8.1ubuntu0.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"bzip2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8.1ubuntu0.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libbz2-1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8.1ubuntu0.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:18.04","package":"libbz2-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8.1ubuntu0.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8ubuntu0.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"bzip2-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8ubuntu0.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libbz2-1.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8ubuntu0.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"TuxCare:Ubuntu:16.04","package":"libbz2-dev","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8ubuntu0.2+tuxcare.els1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.8-5","1.0.8-5.1","1.0.8-6"]},{"source":"osv","ecosystem":"Debian:13","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.8-6"]},{"source":"osv","ecosystem":"Debian:14","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.8-6"]},{"source":"osv","ecosystem":"Mageia:10","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-7.1.mga10"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-5.1.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-9.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP3","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-9.oe2403sp3"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-7.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-7.oe2203sp4"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-23.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"bzip2-devel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-23.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"bzip2-libs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-23.2.hum1"}]}]},{"source":"osv","ecosystem":"Red Hat:hummingbird:1","package":"bzip2-static","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.0.8-23.2.hum1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-4.aikido.2"},{"fixed":"1.0.8-4.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:11","package":"rootio-bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-4.aikido.2"},{"fixed":"1.0.8-4.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-5.aikido.4"},{"fixed":"1.0.8-5.aikido.2"},{"fixed":"1.0.8-5.aikido.3"},{"fixed":"1.0.8-5.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:12","package":"rootio-bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-5.aikido.4"},{"fixed":"1.0.8-5.aikido.2"},{"fixed":"1.0.8-5.aikido.3"},{"fixed":"1.0.8-5.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-6.aikido.2"},{"fixed":"1.0.8-6.root.io.1"}]}]},{"source":"osv","ecosystem":"Root:Debian:13","package":"rootio-bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-6.aikido.2"},{"fixed":"1.0.8-6.root.io.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.2","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 16.0","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP applications 16.0","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-160000.3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-30.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-150400.3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-150400.3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-150400.3.4.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-150400.3.4.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-5ubuntu0.1~esm3"}]}],"versions":["1.0.6-4","1.0.6-5","1.0.6-5ubuntu0.1~esm1","1.0.6-5ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8ubuntu0.2+esm1"}]}],"versions":["1.0.6-8","1.0.6-8ubuntu0.1","1.0.6-8ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8.1ubuntu0.2+esm1"}]}],"versions":["1.0.6-8.1","1.0.6-8.1ubuntu0.1","1.0.6-8.1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-2ubuntu0.1~esm1"}]}],"versions":["1.0.6-9.2","1.0.8-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-5ubuntu0.1"}]}],"versions":["1.0.8-4ubuntu3","1.0.8-4ubuntu4","1.0.8-5","1.0.8-5build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-5.1ubuntu0.1"}]}],"versions":["1.0.8-5build1","1.0.8-5ubuntu1","1.0.8-5.1","1.0.8-5.1build0.1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.8-6","1.0.8-6build1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.0.8-6build2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-6ubuntu0.1"}]}],"versions":["1.0.8-6build1","1.0.8-6build2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-5ubuntu0.1~esm3"}]}],"versions":["1.0.6-4","1.0.6-5","1.0.6-5ubuntu0.1~esm1","1.0.6-5ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8ubuntu0.2+esm1"}]}],"versions":["1.0.6-8","1.0.6-8ubuntu0.1","1.0.6-8ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.6-8.1ubuntu0.2+esm1"}]}],"versions":["1.0.6-8.1","1.0.6-8.1ubuntu0.1","1.0.6-8.1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-2ubuntu0.1~esm1"}]}],"versions":["1.0.6-9.2","1.0.8-2"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-5ubuntu0.1"}]}],"versions":["1.0.8-4ubuntu3","1.0.8-4ubuntu4","1.0.8-5","1.0.8-5build1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-5.1ubuntu0.1"}]}],"versions":["1.0.8-5build1","1.0.8-5ubuntu1","1.0.8-5.1","1.0.8-5.1build0.1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-6ubuntu0.1"}]}],"versions":["1.0.8-6build1","1.0.8-6build2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 16.0","package":"bzip2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.8-160000.3.1"}]}]}],"products":[{"vendor":"bzip2","product":"bzip2"},{"vendor":"open source","product":"bzip2"}],"references":[{"url":"https://cert.pl/en/posts/2026/05/CVE-2026-42250/","tags":["third-party-advisory","article","report"]},{"url":"https://sourceware.org/bzip2/","tags":["product","article"]},{"url":"https://inbox.sourceware.org/bzip2-devel/20260528145407.293768-1-mark@klomp.org/","tags":["vendor-advisory","web","report"]},{"url":"https://sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67","tags":["patch"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-42250","tags":["web","advisory"]},{"url":"https://cert.pl/en/posts/2026/05/CVE-2026-42250"},{"url":"https://sourceware.org/bzip2"},{"url":"https://inbox.sourceware.org/bzip2-devel/20260528145407.293768-1-mark@klomp.org"},{"url":"https://github.com/advisories/GHSA-9r29-3vrx-4537"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2026-42250","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu18.04els/CLSA-2026-1788430930.html","tags":["advisory"]},{"url":"https://errata.tuxcare.com/els_os/ubuntu16.04els/CLSA-2026-1788815685.html","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-42250","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2026-0403.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=36240","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/5BZUFTRN4TGNACBM45SR6YO5FURLM3CM/","tags":["web"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2786","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:30268","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-42250","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/","tags":["article"]},{"url":"https://images.redhat.com/","tags":["article"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_30268.json","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2482704","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-42250","tags":["advisory","report"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623415-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1266786","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42250","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623442-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623494-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-202623627-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263925-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20264055-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-42250","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-8685-1","tags":["advisory"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-42250","title":"Off-by-One Leading to Out-of-Bounds Write in bzip2","description":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67","status":"published","published":"2026-05-28T13:15:19.66Z","modified":"2026-06-05T07:47:33.397Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium","assessor":"cna"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T13:40:23.731501Z"}],"euvd":[{"id":"EUVD-2026-32898","description":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67","status":"published","published":"2026-05-28T13:15:19Z","modified":"2026-06-05T07:47:33Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T18:20:52.238484Z"}],"ghsa":[{"id":"GHSA-9r29-3vrx-4537","title":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially...","description":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 version 1.0.9","status":"published","published":"2026-05-28T15:39:50Z","modified":"2026-05-28T18:30:29Z","cvss":[{"version":"4.0","score":5.1,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T15:08:21.544183Z"}],"nvd":[{"id":"CVE-2026-42250","description":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67","status":"published","published":"2026-05-28T14:16:19.89Z","modified":"2026-06-17T10:47:34.687Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium","assessor":"secondary"}],"cwes":["CWE-787"],"updated_at":"2026-11-02T14:12:21.244426Z"}],"osv":[{"id":"DEBIAN-CVE-2026-42250","description":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).  This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67","status":"published","published":"2026-05-28T14:16:19.89Z","modified":"2026-10-01T03:03:23.421371952Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"medium"}],"updated_at":"2026-11-02T15:45:54.892385Z"},{"id":"OESA-2026-2786","title":"bzip2 security update","description":"bzip2 is a freely available, patent free, high-quality data compressor. It typically compresses files to within 10% to 15% of the best available techniques (the PPM family of statistical compressors), whilst being around twice as fast at compression and six times faster at decompression.\r\n\r\nSecurity Fix(es):\n\nbzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67(CVE-2026-42250)","status":"published","published":"2026-06-24T11:11:42Z","modified":"2026-08-18T01:21:12.161196391Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T15:52:46.449097Z"},{"id":"RHSA-2026:30268","title":"Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update","status":"published","published":"2026-06-27T10:25:29Z","modified":"2026-10-16T10:15:30Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:53:19.963895Z"},{"id":"UBUNTU-CVE-2026-42250","description":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67","status":"published","published":"2026-05-28T14:16:00Z","modified":"2026-10-17T12:58:16.125511586Z","cvss":[{"version":"4.0","score":4.8,"vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N","level":"medium"}],"updated_at":"2026-11-02T16:56:18.393417Z"},{"id":"AZL-88809","title":"CVE-2026-42250 affecting package bzip2 for versions less than 1.0.8-2","description":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67","status":"published","published":"2026-05-28T14:16:19Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.436971Z"},{"id":"AZL-89190","title":"CVE-2026-42250 affecting package kata-containers-cc for versions less than 3.15.0.aks0-15","description":"bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).\n\nThis issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67","status":"published","published":"2026-05-28T14:16:19Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:25.436971Z"},{"id":"BELL-CVE-2026-42250","status":"published","published":"2026-06-02T06:11:38.89114Z","modified":"2026-06-17T07:15:04.295122832Z","updated_at":"2026-11-02T15:28:23.844435Z"},{"id":"CLSA-2026-1788430930","title":"Fix CVE(s): CVE-2026-42250","description":"   * SECURITY UPDATE: out-of-bounds read and write in bzip2recover when a\n     .bz2 file yields more than BZ_MAX_HANDLED_BLOCKS block boundaries\n     (ELSCVE-178967)\n     - debian/patches/CVE-2026-42250.patch: correct the off-by-one in the\n       block-count guard in bzip2recover.c, so the scanning loop stops one\n       block earlier instead of indexing one past bStart, bEnd, rbStart\n       and rbEnd.\n     - CVE-2026-42250","status":"published","published":"2026-09-03T10:22:20Z","modified":"2026-10-26T09:32:04.1919221Z","updated_at":"2026-11-02T15:43:47.591214Z"},{"id":"CLSA-2026-1788815685","title":"Fix CVE(s): CVE-2026-42250","description":"   * SECURITY UPDATE: out-of-bounds read and write in bzip2recover when a\n     .bz2 file yields more than BZ_MAX_HANDLED_BLOCKS block boundaries\n     (ELSCVE-178964)\n     - debian/patches/CVE-2026-42250.patch: correct the off-by-one in the\n       block-count guard in bzip2recover.c, so the scanning loop stops one\n       block earlier instead of indexing one past bStart, bEnd, rbStart\n       and rbEnd.\n     - CVE-2026-42250","status":"published","published":"2026-09-07T21:14:57Z","modified":"2026-10-26T09:32:02.23904158Z","updated_at":"2026-11-02T15:43:47.938828Z"},{"id":"MGASA-2026-0403","title":"Updated bzip2 packages fix a security vulnerability","description":"Off-by-One Leading to Out-of-Bounds Write in bzip2. (CVE-2026-42250\n","status":"published","published":"2026-09-14T16:26:35Z","modified":"2026-09-14T16:30:41.350748206Z","updated_at":"2026-11-02T15:49:43.795591Z"},{"id":"openSUSE-SU-2026:11627-1","title":"bzip2-1.0.8-6.1 on GA media","description":"These are all security issues fixed in the bzip2-1.0.8-6.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-08-28T00:00:00Z","modified":"2026-08-29T09:15:04.358834943Z","updated_at":"2026-11-02T16:58:39.516824Z"},{"id":"openSUSE-SU-2026:21762-1","title":"Security update for bzip2","description":"This update for bzip2 fixes the following issue:\n\n- CVE-2026-42250: off-by-one error in the `bzip2recover` utility when processing a specially crafted file can lead to a\n  crash (bsc#1266786).\n","status":"published","published":"2026-09-04T13:48:44Z","modified":"2026-09-09T18:23:14.577053173Z","updated_at":"2026-11-02T16:58:42.426393Z"},{"id":"ROOT-OS-DEBIAN-11-CVE-2026-42250","title":"CVE-2026-42250 in bzip2 - Patched by Root","description":"Root has patched CVE-2026-42250 in the bzip2 package for Root:Debian:11. Multiple fixed versions available.","status":"published","published":"2026-08-20T12:40:41Z","modified":"2026-08-20T13:30:07.928482166Z","updated_at":"2026-11-02T15:53:29.900552Z"},{"id":"ROOT-OS-DEBIAN-12-CVE-2026-42250","title":"CVE-2026-42250 in bzip2 - Patched by Root","description":"Root has patched CVE-2026-42250 in the bzip2 package for Root:Debian:12. Multiple fixed versions available.","status":"published","published":"2026-08-25T08:22:44Z","modified":"2026-08-26T01:10:51.360728241Z","updated_at":"2026-11-02T15:53:32.037361Z"},{"id":"ROOT-OS-DEBIAN-13-CVE-2026-42250","title":"CVE-2026-42250 in bzip2 - Patched by Root","description":"Root has patched CVE-2026-42250 in the bzip2 package for Root:Debian:13. Multiple fixed versions available.","status":"published","published":"2026-08-24T06:40:31Z","modified":"2026-08-24T08:15:09.422624151Z","updated_at":"2026-11-02T15:53:33.681527Z"},{"id":"SUSE-SU-2026:23415-1","title":"Security update for bzip2","description":"This update for bzip2 fixes the following issue:\n\n- CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a\n  crash (bsc#1266786).\n","status":"published","published":"2026-09-01T06:55:18Z","modified":"2026-09-14T18:23:09.974569993Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23442-1","title":"Security update for bzip2","description":"This update for bzip2 fixes the following issue:\n\n- CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a\n  crash (bsc#1266786).\n","status":"published","published":"2026-09-01T07:06:07Z","modified":"2026-09-14T18:23:11.049092681Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23494-1","title":"Security update for bzip2","description":"This update for bzip2 fixes the following issue:\n\n- CVE-2026-42250: off-by-one error in the `bzip2recover` utility when processing a specially crafted file can lead to a\n  crash (bsc#1266786).\n","status":"published","published":"2026-09-04T13:48:51Z","modified":"2026-09-14T18:23:13.1653143Z","updated_at":"2026-11-02T15:54:03.503431Z"},{"id":"SUSE-SU-2026:23627-1","title":"Security update for bzip2","description":"This update for bzip2 fixes the following issue:\n\n- CVE-2026-42250: off-by-one error in the `bzip2recover` utility when processing a specially crafted file can lead to a\n  crash (bsc#1266786).\n","status":"published","published":"2026-09-04T13:48:51Z","modified":"2026-09-29T18:23:20.108977546Z","updated_at":"2026-11-02T15:54:03.991985Z"},{"id":"SUSE-SU-2026:3925-1","title":"Security update for bzip2","description":"This update for bzip2 fixes the following issue:\n\n- CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a\n  crash (bsc#1266786).\n","status":"published","published":"2026-09-02T14:55:34Z","modified":"2026-09-10T18:23:21.568044879Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"SUSE-SU-2026:4055-1","title":"Security update for bzip2","description":"This update for bzip2 fixes the following issue:\n\n- CVE-2026-42250: off-by-one error in the bzip2recover utility when processing a specially crafted file can lead to a\n  crash (bsc#1266786).\n","status":"published","published":"2026-09-07T15:48:29Z","modified":"2026-09-13T18:23:18.864821903Z","updated_at":"2026-11-02T15:54:05.392906Z"},{"id":"USN-8685-1","title":"bzip2 vulnerability","description":"It was discovered that bzip2 did not properly manage memory under certain\ncircumstances. An attacker could possibly use this issue to cause a crash,\nresulting in a denial of service.","status":"published","published":"2026-08-27T11:18:57Z","modified":"2026-09-01T09:55:50.415111477Z","updated_at":"2026-11-02T16:58:25.103481Z"}]}}