Loading story…
Python disclosed CVE-2026-9669, a high-severity flaw in CPython's bz2.BZ2Decompressor that can cause a stack buffer overflow when applications continue using the same decompressor object after a decompression error. If software catches the resulting OSError and retries with attacker-crafted compressed data, decompression can resume from an invalid internal state, leading to out-of-bounds writes to a stack buffer and potentially crashing the process while handling untrusted input.
The issue was reported in CPython as gh-150599, and maintainers merged a fix in pull request #150600 to block decompressor reuse after errors by preserving libbz2 error state and raising ValueError on reuse. Python published the vulnerability through its security-announce channel and it was echoed on the oss-security mailing list, while remediation was prepared for the main branch and backported to supported releases including Python 3.15, 3.14, 3.13, and 3.12.
See affected versions and whether adversaries are exploiting it.
5 events from the most recent confirmed update back to the earliest known activity.
Python's security-announce mailing list disclosed CVE-2026-9669 as a high-severity vulnerability in CPython's bz2.BZ2Decompressor. The advisory explained that reusing a decompressor after an OSError can resume from an invalid state and cause a stack buffer overflow when handling crafted input.
The CPython pull request associated with the bz2 decompressor flaw was explicitly tagged with the type-security label, marking it as a security issue in project tracking.
The security fix for the bz2 stack buffer overflow was merged into the CPython main branch. The remediation was also prepared for backporting to supported release branches.
A pull request was opened to fix the bz2 flaw by storing libbz2 decompression errors on the BZ2Decompressor object and preventing reuse after an error, including raising a ValueError in the affected path.
A CPython issue was opened reporting a crash in the bz2 decompressor related to reusing a BZ2Decompressor after an error. The report became the tracked issue for the vulnerability later assigned CVE-2026-9669.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
seclists.org
Open sourcemail.python.org
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A technical writeup detailed how a flaw in andyherbert’s `lz1`/`lz77` decompression routine can be exploited to achieve remote code execution by supplying crafted compressed data. The bug arises because the decompressor limits `coding_pos` using `uncompressed_size`, but an inner copy loop continues incrementing `coding_pos` without enforcing the same boundary, allowing writes past the end of `uncompressed_text`. The first four bytes of attacker-controlled input determine `uncompressed_size`, and pointer metadata such as length can then be abused to trigger an out-of-bounds write. The demonstrated exploitation path replaced heap allocation with stack allocation using `alloca`, turning the overflow into a stack-based attack capable of overwriting adjacent variables, saved frame data, and the return address. In a statically compiled, non-PIE `amd64` binary, the exploit used a ROP chain to call `_dl_make_stacks_executable`, pivoted execution with a `jmp rsp` gadget, and ran shellcode that opened a reverse shell. The author noted that earlier fuzzing with `afl-fuzz` had already uncovered crashing inputs tied to the vulnerable logic.
Jun 29, 2026
CPython disclosed two medium-severity vulnerabilities affecting distinct parts of the runtime and tooling. **CVE-2026-1502** allows CR/LF bytes to pass through HTTP client proxy tunnel header or host handling, creating a header-injection risk in proxy tunnel scenarios. The issue was published through Python security channels and the `oss-sec` mailing list, with remediation details tracked in the CVE record and an associated CPython pull request. A second flaw, **CVE-2026-5713**, affects CPython remote debugging and introspection features and can trigger out-of-bounds read and write behavior when a privileged Python process connects to a malicious or compromised Python target. The bug impacts newer capabilities including `profiling.sampling` in Python 3.15+ and asyncio inspection commands such as ``` python -m asyncio ps python -m asyncio pstree ``` in Python 3.14+, and exploitation is expected to be unstable because the connecting process is likely to crash under ASLR.
Jun 29, 2026
Researchers disclosed **CVE-2026-48095**, a critical heap buffer overflow in 7-Zip affecting version `26.00` and earlier that can lead to application crashes, denial of service, or arbitrary code execution. The bug, reported by Jaroslav Lobačevski of GitHub Security Lab and tracked in advisory `GHSL-2026-140`, resides in the NTFS archive handler’s `CInStream::GetCuSize()` logic, where an under-allocation can shrink a buffer to 1 byte before a later operation writes up to 256 MB of attacker-controlled data into it. The resulting heap corruption can overwrite adjacent objects, including a stream object’s **vtable** pointer, creating a path to code execution. The vulnerability can be triggered simply by opening a specially crafted file because 7-Zip uses signature-based fallback detection and may route files disguised as `.7z`, `.zip`, or `.rar` into the vulnerable NTFS parser regardless of extension. Reports say both 32-bit and 64-bit builds are affected, with 64-bit systems that have sufficient memory more likely to reach reliable code execution, while lower-memory systems may instead crash. Public disclosure included technical details and a Python proof-of-concept generator, raising the risk of weaponization; the issue carries a **CVSS 3.1 score of 8.8**, and users are being urged to update 7-Zip and avoid opening untrusted archives.
Jun 29, 2026