CVE-2026-42250
Off-by-One Write in bzip2recover Utility
Publication date: 2026-05-28
Last updated on: 2026-05-28
Assigner: CERT.PL
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| the_bzip2_project | bzip2 | 1.0.9 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-787 | The product writes data past the end, or before the beginning, of the intended buffer. |
Attack-Flow Graph
AI Powered Q&A
How can this vulnerability impact me? :
The impact of this vulnerability is primarily a denial of service. An attacker could cause the bzip2recover utility to crash by providing a specially crafted file, which leads to memory corruption due to an out-of-bounds write.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, update the bzip2 package to version 1.0.9 or later, where the off-by-one error in the bzip2recover utility has been fixed.
Can you explain this vulnerability to me?
This vulnerability is an off-by-one error in the bzip2recover utility of the bzip2 software. When the utility processes a specially crafted file, it performs an out-of-bounds write to a global buffer. This causes memory corruption and can lead to the application crashing, resulting in a denial of service.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The provided information does not specify any direct impact of the CVE-2026-42250 vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability affects the bzip2recover utility in bzip2 versions prior to 1.0.9. Detection involves identifying if vulnerable versions of bzip2 are installed on your system.
You can check the installed bzip2 version using the following command:
- bzip2recover --version
If the version is earlier than 1.0.9, your system is vulnerable.
Additionally, monitoring for crashes or denial of service events related to bzip2recover when processing files may indicate exploitation attempts.