4.8

CVE-2026-42250: bzip2 Out-of-bounds Write

CVSS: 4.8v4.0MediumAwaiting analysis
AliasesMGASA-2026-0403SUSE-SU-2026:23415-1SUSE-SU-2026:23442-1
Published 28-05-2026Last modified 05-06-2026
Open JSON

Vulnerability summary

CVE-2026-42250 is a medium (CVSS 4.8) Out-of-bounds Write vulnerability in bzip2. EPSS estimates a 0.18% chance of exploitation in the next 30 days, higher than 7.3% of scored vulnerabilities.

Overall risk
19/100
0100
Low · default modelHow is this calculated?
CVSS score
4.8/10
010
Medium · v4.0 (CVE.org)
EPSS score
0.18%
0%100%
Low · +0.06 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 28-05-2026
    PublishedVulnerability first disclosed.
  2. 05-06-2026
    Last modifiedVulnerability information updated.

Description

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67

CVSS metrics

5 scores · 5 sources · 2 versions

EPSS trend

Probability

0.18%

Chance of exploitation in the next 30 days

Percentile

7%

Versus all other CVEs

30-day change

+0.06 pp

From 0.13% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.18%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Suse10 products
  • bzip2&distro=SUSE Linux Enterprise Micro 5.3< 1.0.8-150400.3.4.1
  • bzip2&distro=SUSE Linux Enterprise Micro 5.4< 1.0.8-150400.3.4.1
  • bzip2&distro=SUSE Linux Enterprise Micro 5.5< 1.0.8-150400.3.4.1
  • bzip2&distro=SUSE Linux Enterprise Module for Basesystem 15 SP7< 1.0.8-150400.3.4.1
  • bzip2&distro=SUSE Linux Enterprise Server 16.0< 1.0.8-160000.3.1
Redhat4 products
  • bzip2< 0:1.0.8-23.2.hum1
  • bzip2-devel< 0:1.0.8-23.2.hum1
  • bzip2-libs< 0:1.0.8-23.2.hum1
  • bzip2-static< 0:1.0.8-23.2.hum1
Mageia2 products
  • bzip2< 1.0.8-7.1.mga10
  • bzip2< 1.0.8-5.1.mga9
Opensuse2 products
  • bzip2&distro=openSUSE Leap 16.0< 1.0.8-160000.3.1
  • bzip2&distro=openSUSE Tumbleweed< 1.0.8-6.1
Bzip21 product
Debian1 product
  • bzip2All versions (No fix recorded)
Ubuntu1 product
  • bzip2< 1.0.6-5ubuntu0.1~esm3 | < 1.0.6-8ubuntu0.2+esm1 | < 1.0.6-8.1ubuntu0.2+esm1 | < 1.0.8-2ubuntu0.1~esm1 | < 1.0.8-5ubuntu0.1 | < 1.0.8-5.1ubuntu0.1 | All versions (No fix recorded) | < 1.0.8-6ubuntu0.1

7 vendors · 21 products

References

26 links
Show all 26 references