CVE-2026-42250 Off-by-One Leading to Out-of-Bounds Write in bzip2
An off-by-one error in bzip2recover allows attackers to cause memory corruption and denial of service via a crafted file.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-42250?
CVE-2026-42250 is a medium-severity memory corruption vulnerability in bzip2, published on 28 May 2026. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).
This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67
Weakness: CWE-787
Which versions are affected by CVE-2026-42250?
Linux distribution packages (16)
bzip2 Red Hat:hummingbird:1 | All versions | 0:1.0.8-23.2.hum1 |
bzip2-devel Red Hat:hummingbird:1 | All versions | 0:1.0.8-23.2.hum1 |
bzip2-libs Red Hat:hummingbird:1 | All versions | 0:1.0.8-23.2.hum1 |
bzip2-static Red Hat:hummingbird:1 | All versions | 0:1.0.8-23.2.hum1 |
bzip2 SUSE:Linux Enterprise Micro 5.3 | All versions | 1.0.8-150400.3.4.1 |
bzip2 SUSE:Linux Enterprise Micro 5.4 | All versions | 1.0.8-150400.3.4.1 |
bzip2 SUSE:Linux Enterprise Micro 5.5 | All versions | 1.0.8-150400.3.4.1 |
bzip2 SUSE:Linux Enterprise Module for Basesystem 15 SP7 | All versions | 1.0.8-150400.3.4.1 |
bzip2 SUSE:Linux Enterprise Server 16.0 | All versions | 1.0.8-160000.3.1 |
bzip2 SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5 | All versions | 1.0.6-30.17.1 |
bzip2 SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 1.0.8-160000.3.1 |
bzip2 SUSE:Linux Micro 6.0 | All versions | 1.0.8-4.1 |
bzip2 SUSE:Linux Micro 6.1 | All versions | 1.0.8-slfo.1.1_2.1 |
bzip2 SUSE:Linux Micro 6.2 | All versions | 1.0.8-160000.3.1 |
bzip2 openSUSE:Leap 16.0 | All versions | 1.0.8-160000.3.1 |
bzip2 openSUSE:Tumbleweed | All versions | 1.0.8-6.1 |
How do I fix CVE-2026-42250?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-42250 being exploited?
There is no known exploitation of CVE-2026-42250 in the wild and no public exploit code.
Sources
Also known as AZL-88809, AZL-89190, BELL-CVE-2026-42250, CLSA-2026-1788430930, CLSA-2026-1788815685, DEBIAN-CVE-2026-42250 and 18 more.