{"schema_version":"1.9.0","id":"CVE-2026-9669","published":"2026-06-08T22:01:15.420Z","modified":"2026-08-15T17:18:48.062818Z","aliases":["BIT-libpython-2026-9669","BIT-python-2026-9669","BIT-python-min-2026-9669","PSF-2026-27"],"related":["CGA-w7r7-76wj-xg3r","openSUSE-SU-2026:11181-1"],"summary":"bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow","details":"bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.","affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/python/cpython","events":[{"introduced":"0"},{"introduced":"deaf509e8fc6e0363bd6f26d52ad42f976ec42f2"},{"introduced":"0fb18b02c8ad56299d6a2910be0bab8ad601ef24"},{"introduced":"60403a5409ff2c3f3b07dd2ca91a7a3e096839c7"},{"introduced":"ebf955df7a89ed0c7968f79faec1de49f61ed7cb"},{"introduced":"f31a89bb901067dd105b00cfa90523cf7ffdbbdd"},{"fixed":"3a19c2f0b3e91ce8f23d0cc64d4c9ee557823f24"},{"fixed":"41388c9cb160d0886d5ca00d2e6c8782608a4549"},{"fixed":"2abcf904b8dac8c999d2b3aac76681abb333798a"},{"fixed":"fd17997c3866d61e0e7bd8201b1d8f35b40a40bd"},{"fixed":"c63aec69bd59c55314c06c23f4c22c03de76fe45"},{"fixed":"cf16a33fad15d1058ed71b92573d0bed57f85457"},{"fixed":"157a5df8cb5d82b33f918a7489e72ce95ceb12b6"},{"fixed":"1ba6135eae75ad8413413caeeedb56ae72320636"},{"fixed":"5755d0f083949ff3c5bf3a37e673e24e306b036e"},{"fixed":"619a12b2e545391dc436b3af79dda22337382a6f"},{"fixed":"938ec030e90c5e53f1faac6fab1643f14e4f4a79"},{"fixed":"991e6cf86496718c4ef00b362d640e00cb5c85b2"},{"fixed":"d3ca26983dfbccdf609f24ff5877dc3118e4702d"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"3.10.21"},{"introduced":"3.11.0"},{"fixed":"3.11.16"},{"introduced":"3.12.0"},{"fixed":"3.12.14"},{"introduced":"3.13.0"},{"fixed":"3.13.14"},{"introduced":"3.14.0"},{"fixed":"3.14.6"},{"introduced":"3.15.0a1"},{"fixed":"3.15.0b3"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v3.15.0b2","v3.14.5","v3.15.0b1","v3.14.5rc1","v3.13.13","v3.14.4","v3.12.13","v3.10.20","v3.11.15","v3.13.12","v3.14.3","v3.14.2","v3.13.11","v3.13.10","v3.14.1","v3.13.8","v3.11.14","v3.10.19","v3.12.12","v3.14.0","v3.13.7","v3.13.6","v3.13.5","v3.13.4","v3.11.13","v3.10.18","v3.12.11","v3.13.3","v3.11.12","v3.12.10","v3.10.17","v3.13.2","v3.12.9","v3.13.1","v3.12.8","v3.10.16","v3.11.11","v3.13.0","v3.12.7","v3.11.10","v3.10.15","v3.12.6","v3.12.5","v3.12.4","v3.12.3","v3.11.9","v3.10.14","v3.12.2","v3.11.8","v3.12.1","v3.11.7","v3.11.6","v3.12.0","v3.11.5","v3.10.13","v3.11.4","v3.10.12","v3.10.11","v3.11.3","v3.10.10","v3.11.2","v3.10.9","v3.11.1","v3.11.0rc2","v3.10.8","v3.10.7","v3.11.0rc1","v3.10.6","v3.11.0b5","v3.11.0b4","v3.10.5","v3.11.0b3","v3.11.0b2","v3.11.0b1","v3.11.0a7","v3.10.4","v3.10.3","v3.11.0a6","v3.11.0a5","v3.11.0a4","v3.10.2","v3.11.0a3","v3.10.1","v3.10.0rc2","v3.10.0rc1","v3.10.0b4","v3.10.0b3","v3.10.0b2","v3.10.0b1","v3.10.0a7","v3.10.0a1","v3.9.0a2","v3.7.0a2","v3.6.0b1","v3.6.0a3","v3.5.0b1","v3.5.0a4","v3.5.0a3","v3.5.0a2","v3.5.0a1","v3.4.0b3","v3.4.0b2","v3.4.0b1","v3.4.0a4","v3.4.0a3","v3.4.0a2","v3.4.0a1","v3.3.0rc3","v3.3.0rc2","v3.3.0rc1","v3.3.0b2","v3.3.0b1","v3.3.0a4","v3.3.0a3","v3.3.0a2","v3.2rc3","v3.2rc2","v3.2rc1","v3.2b2","v3.2b1","v3.2a4","v3.2a3","v3.2a2","v3.2a1","v3.1","v3.1rc2","v3.1rc1","v3.1b1","v3.1a2","v3.1a1","v3.0rc3","v3.0rc2","v3.0rc1","v3.0b3","v3.0b2","v3.0b1","v3.0a5","v3.0a4","v3.0a3","v3.0a2","v3.0a1","v2.4","v2.4c1","v2.4b2","v2.4b1","v2.4a3","v2.4a2","v2.4a1","v2.3c2","v2.3c1","v2.2a3","v2.1","v2.1c2","v2.1c1","v2.1b2","v2.1b1","v2.1a2","v2.1a1","v2.0","v2.0c1","v2.0b2","v2.0b1","v1.6a2","v1.6a1","v1.5.2","v1.5.2c1","v1.5.2b2","v1.5.2b1","v1.5.2a2","v1.5.2a1","v1.5.1","v1.5","v1.5b2","v1.5b1","v1.5a4","v1.5a3","v1.5a2","v1.5a1","v1.4","v1.4b3","v1.4b2","v1.4b1","v1.3","v1.3b1","v1.2","v1.2b4","v1.2b3","v1.2b2","v1.2b1","v1.1.1","v1.1","v1.0.2","v1.0.1","v0.9.9","v0.9.8"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-9669.json","vanir_signatures":[{"deprecated":false,"digest":{"line_hashes":["230549807586347801882752565727751527393","259826515629445840524055930255270819569","61884081560884315263548559216161355479","79711694314862108340541197613207575946","171752414468768194608689478864728584766","244896825634063513341487830919391053623","270116362062481798266002745410761144483","301458273768679745851477136163384738787","326679068747380593195372742629785605814","63860159810743592708049383519597402068","227962660283150036829664603411509087708","65322514126625934999787331933915003546","139742599704273432116709087783106689796","153074271145615424374466652844640026183","50516197816847867676426154913464944742","244810537808551927082172479326136103730","78008322251762917482327059398879438299","144386537560936543665995043702583976800","65932039932521334349816198447986332847"],"threshold":0.9},"id":"CVE-2026-9669-3e9eb39f","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79","target":{"file":"Modules/_bz2module.c"}},{"deprecated":false,"digest":{"line_hashes":["230549807586347801882752565727751527393","259826515629445840524055930255270819569","61884081560884315263548559216161355479","79711694314862108340541197613207575946","171752414468768194608689478864728584766","244896825634063513341487830919391053623","270116362062481798266002745410761144483","135851173470804331812991044096892707406","187850330169432792462433470324067099149","46264331593371765365053503316412057156","287546421518025134782360525923429325649","144711800226151315620070234557395546186","139742599704273432116709087783106689796","303706301689659795029483786708038468343","260603280173778536467919405606800329863","37282471943017895370075327536954715750","329688701832568305911903580974753306128","169032784915282225376038835778399062686","222725239250192608948367063362424983213","129741306537458160456606408761404801673"],"threshold":0.9},"id":"CVE-2026-9669-43d1a68c","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d","target":{"file":"Modules/_bz2module.c"}},{"deprecated":false,"digest":{"function_hash":"12475210129250170784485077059971131042","length":967},"id":"CVE-2026-9669-4bdcb445","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/1ba6135eae75ad8413413caeeedb56ae72320636","target":{"file":"Modules/_bz2module.c","function":"decompress_buf"}},{"deprecated":false,"digest":{"function_hash":"43861071656797244308731160845717430801","length":725},"id":"CVE-2026-9669-539b7f6c","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/991e6cf86496718c4ef00b362d640e00cb5c85b2","target":{"file":"Modules/_bz2module.c","function":"_bz2_BZ2Decompressor_impl"}},{"deprecated":false,"digest":{"function_hash":"237157038820676258852447556561399486795","length":305},"id":"CVE-2026-9669-583d2510","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f","target":{"file":"Modules/_bz2module.c","function":"_bz2_BZ2Decompressor_decompress_impl"}},{"deprecated":false,"digest":{"function_hash":"12475210129250170784485077059971131042","length":967},"id":"CVE-2026-9669-5a90cf92","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f","target":{"file":"Modules/_bz2module.c","function":"decompress_buf"}},{"deprecated":false,"digest":{"function_hash":"34611679669226167337538490498463485692","length":692},"id":"CVE-2026-9669-5de0d4fe","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/1ba6135eae75ad8413413caeeedb56ae72320636","target":{"file":"Modules/_bz2module.c","function":"_bz2_BZ2Decompressor___init___impl"}},{"deprecated":false,"digest":{"function_hash":"324494633129969884664463818217685591182","length":327},"id":"CVE-2026-9669-64edab57","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e","target":{"file":"Modules/_bz2module.c","function":"_bz2_BZ2Decompressor_decompress_impl"}},{"deprecated":false,"digest":{"function_hash":"12475210129250170784485077059971131042","length":967},"id":"CVE-2026-9669-69cba27d","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/991e6cf86496718c4ef00b362d640e00cb5c85b2","target":{"file":"Modules/_bz2module.c","function":"decompress_buf"}},{"deprecated":false,"digest":{"function_hash":"12475210129250170784485077059971131042","length":967},"id":"CVE-2026-9669-74a63175","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6","target":{"file":"Modules/_bz2module.c","function":"decompress_buf"}},{"deprecated":false,"digest":{"function_hash":"34611679669226167337538490498463485692","length":692},"id":"CVE-2026-9669-75ab72d2","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79","target":{"file":"Modules/_bz2module.c","function":"_bz2_BZ2Decompressor___init___impl"}},{"deprecated":false,"digest":{"line_hashes":["230549807586347801882752565727751527393","259826515629445840524055930255270819569","61884081560884315263548559216161355479","79711694314862108340541197613207575946","171752414468768194608689478864728584766","244896825634063513341487830919391053623","270116362062481798266002745410761144483","301458273768679745851477136163384738787","326679068747380593195372742629785605814","63860159810743592708049383519597402068","227962660283150036829664603411509087708","65322514126625934999787331933915003546","139742599704273432116709087783106689796","153074271145615424374466652844640026183","50516197816847867676426154913464944742","244810537808551927082172479326136103730","171848629098389974293193736390253590171","284304586435141485197444375467611256436","209901103058700644331660527939509813016"],"threshold":0.9},"id":"CVE-2026-9669-767a64d1","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f","target":{"file":"Modules/_bz2module.c"}},{"deprecated":false,"digest":{"function_hash":"237157038820676258852447556561399486795","length":305},"id":"CVE-2026-9669-7e0deda7","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/1ba6135eae75ad8413413caeeedb56ae72320636","target":{"file":"Modules/_bz2module.c","function":"_bz2_BZ2Decompressor_decompress_impl"}},{"deprecated":false,"digest":{"function_hash":"324494633129969884664463818217685591182","length":327},"id":"CVE-2026-9669-83b70eb1","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d","target":{"file":"Modules/_bz2module.c","function":"_bz2_BZ2Decompressor_decompress_impl"}},{"deprecated":false,"digest":{"function_hash":"290164687798376905522712649084948442447","length":982},"id":"CVE-2026-9669-88372235","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d","target":{"file":"Modules/_bz2module.c","function":"decompress_buf"}},{"deprecated":false,"digest":{"function_hash":"290164687798376905522712649084948442447","length":982},"id":"CVE-2026-9669-97b4386a","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e","target":{"file":"Modules/_bz2module.c","function":"decompress_buf"}},{"deprecated":false,"digest":{"line_hashes":["230549807586347801882752565727751527393","259826515629445840524055930255270819569","61884081560884315263548559216161355479","79711694314862108340541197613207575946","171752414468768194608689478864728584766","244896825634063513341487830919391053623","270116362062481798266002745410761144483","301458273768679745851477136163384738787","326679068747380593195372742629785605814","63860159810743592708049383519597402068","227962660283150036829664603411509087708","65322514126625934999787331933915003546","139742599704273432116709087783106689796","153074271145615424374466652844640026183","50516197816847867676426154913464944742","244810537808551927082172479326136103730","78008322251762917482327059398879438299","144386537560936543665995043702583976800","65932039932521334349816198447986332847"],"threshold":0.9},"id":"CVE-2026-9669-9cd8c3d5","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/1ba6135eae75ad8413413caeeedb56ae72320636","target":{"file":"Modules/_bz2module.c"}},{"deprecated":false,"digest":{"function_hash":"43861071656797244308731160845717430801","length":725},"id":"CVE-2026-9669-a77dd4db","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f","target":{"file":"Modules/_bz2module.c","function":"_bz2_BZ2Decompressor_impl"}},{"deprecated":false,"digest":{"function_hash":"237157038820676258852447556561399486795","length":305},"id":"CVE-2026-9669-a7eb6970","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6","target":{"file":"Modules/_bz2module.c","function":"_bz2_BZ2Decompressor_decompress_impl"}},{"deprecated":false,"digest":{"function_hash":"237157038820676258852447556561399486795","length":305},"id":"CVE-2026-9669-ba7b4d64","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79","target":{"file":"Modules/_bz2module.c","function":"_bz2_BZ2Decompressor_decompress_impl"}},{"deprecated":false,"digest":{"function_hash":"43861071656797244308731160845717430801","length":725},"id":"CVE-2026-9669-bae64abe","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6","target":{"file":"Modules/_bz2module.c","function":"_bz2_BZ2Decompressor_impl"}},{"deprecated":false,"digest":{"function_hash":"237157038820676258852447556561399486795","length":305},"id":"CVE-2026-9669-bd1fd477","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/991e6cf86496718c4ef00b362d640e00cb5c85b2","target":{"file":"Modules/_bz2module.c","function":"_bz2_BZ2Decompressor_decompress_impl"}},{"deprecated":false,"digest":{"line_hashes":["230549807586347801882752565727751527393","259826515629445840524055930255270819569","61884081560884315263548559216161355479","79711694314862108340541197613207575946","171752414468768194608689478864728584766","244896825634063513341487830919391053623","270116362062481798266002745410761144483","301458273768679745851477136163384738787","326679068747380593195372742629785605814","63860159810743592708049383519597402068","227962660283150036829664603411509087708","65322514126625934999787331933915003546","139742599704273432116709087783106689796","153074271145615424374466652844640026183","50516197816847867676426154913464944742","244810537808551927082172479326136103730","171848629098389974293193736390253590171","284304586435141485197444375467611256436","209901103058700644331660527939509813016"],"threshold":0.9},"id":"CVE-2026-9669-c7eb17c3","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/991e6cf86496718c4ef00b362d640e00cb5c85b2","target":{"file":"Modules/_bz2module.c"}},{"deprecated":false,"digest":{"line_hashes":["230549807586347801882752565727751527393","259826515629445840524055930255270819569","61884081560884315263548559216161355479","79711694314862108340541197613207575946","171752414468768194608689478864728584766","244896825634063513341487830919391053623","270116362062481798266002745410761144483","301458273768679745851477136163384738787","326679068747380593195372742629785605814","63860159810743592708049383519597402068","227962660283150036829664603411509087708","65322514126625934999787331933915003546","139742599704273432116709087783106689796","153074271145615424374466652844640026183","50516197816847867676426154913464944742","244810537808551927082172479326136103730","171848629098389974293193736390253590171","284304586435141485197444375467611256436","209901103058700644331660527939509813016"],"threshold":0.9},"id":"CVE-2026-9669-cffcb8eb","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6","target":{"file":"Modules/_bz2module.c"}},{"deprecated":false,"digest":{"function_hash":"211737575122334054247505236780163694353","length":574},"id":"CVE-2026-9669-dd9baae2","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e","target":{"file":"Modules/_bz2module.c","function":"_bz2_BZ2Decompressor_impl"}},{"deprecated":false,"digest":{"function_hash":"211737575122334054247505236780163694353","length":574},"id":"CVE-2026-9669-e79b54c8","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d","target":{"file":"Modules/_bz2module.c","function":"_bz2_BZ2Decompressor_impl"}},{"deprecated":false,"digest":{"function_hash":"12475210129250170784485077059971131042","length":967},"id":"CVE-2026-9669-fbf82f20","signature_type":"Function","signature_version":"v1","source":"https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79","target":{"file":"Modules/_bz2module.c","function":"decompress_buf"}},{"deprecated":false,"digest":{"line_hashes":["230549807586347801882752565727751527393","259826515629445840524055930255270819569","61884081560884315263548559216161355479","79711694314862108340541197613207575946","171752414468768194608689478864728584766","244896825634063513341487830919391053623","270116362062481798266002745410761144483","135851173470804331812991044096892707406","187850330169432792462433470324067099149","46264331593371765365053503316412057156","287546421518025134782360525923429325649","144711800226151315620070234557395546186","139742599704273432116709087783106689796","303706301689659795029483786708038468343","260603280173778536467919405606800329863","37282471943017895370075327536954715750","329688701832568305911903580974753306128","169032784915282225376038835778399062686","222725239250192608948367063362424983213","129741306537458160456606408761404801673"],"threshold":0.9},"id":"CVE-2026-9669-febb9baa","signature_type":"Line","signature_version":"v1","source":"https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e","target":{"file":"Modules/_bz2module.c"}}],"vanir_signatures_modified":"2026-08-15T17:18:48Z"}}],"references":[{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2026/06/08/17"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9669.json"},{"type":"ADVISORY","url":"https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-9669"},{"type":"REPORT","url":"https://github.com/python/cpython/issues/150599"},{"type":"FIX","url":"https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6"},{"type":"FIX","url":"https://github.com/python/cpython/commit/1ba6135eae75ad8413413caeeedb56ae72320636"},{"type":"FIX","url":"https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e"},{"type":"FIX","url":"https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f"},{"type":"FIX","url":"https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79"},{"type":"FIX","url":"https://github.com/python/cpython/commit/991e6cf86496718c4ef00b362d640e00cb5c85b2"},{"type":"FIX","url":"https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d"},{"type":"FIX","url":"https://github.com/python/cpython/pull/150600"},{"type":"PACKAGE","url":"https://github.com/python/cpython"}],"database_specific":{"cna_assigner":"PSF","cwe_ids":["CWE-121"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/9xxx/CVE-2026-9669.json"},"severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"}]}