PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-9669 Python Software Foundation CVE debrief

CVE-2026-9669 is a HIGH severity vulnerability affecting Python's bz2.BZ2Decompressor objects. The issue allows these objects to be reused after a decompression error. If an application catches the resulting OSError and retries with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.

Vendor
Python Software Foundation
Product
CPython
CVSS
HIGH 8.2
CISA KEV
Not listed in stored evidence
Original CVE published
2026-06-08
Original CVE updated
2026-08-13
Advisory published
2026-06-08
Advisory updated
2026-08-13

Who should care

Developers and users of Python applications that utilize bz2.BZ2Decompressor objects, especially those processing untrusted data, should be aware of this vulnerability.

Technical summary

The vulnerability exists in the bz2.BZ2Decompressor objects in Python. When a decompression error occurs, the object could be reused. If an application retries decompression with the same object, it may lead to out-of-bounds writes due to an invalid internal state.

Defensive priority

HIGH

Recommended defensive actions

  • Update Python to the latest version that includes the fix for this vulnerability.
  • Avoid reusing bz2.BZ2Decompressor objects after a decompression error.
  • Handle decompression errors properly to prevent potential crashes or security issues.

Evidence notes

The CVE record and details are based on information from [cve-org](https://www.cve.org/CVERecord?id=CVE-2026-9669) and [nvd](https://nvd.nist.gov/vuln/detail/CVE-2026-9669).

Sources and references

Verified primary and authoritative sources

  • CVE-2026-9669 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-9669

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-9669 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-9669

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.