CVE-2026-9669: python software foundation cpython Stack-based Buffer Overflow
CVSS: 8.2v4.0HighAwaiting analysis
AliasesALPINE-CVE-2026-9669UBUNTU-CVE-2026-9669DEBIAN-CVE-2026-9669CGA-4pcf-5g2f-cx3vCGA-6g27-vwch-63gcCGA-6gq4-x9mc-3r5pCGA-7rh5-r4p7-67cjCGA-8h37-hcmc-3mw2CGA-hhqg-3qwg-5cc2CGA-j6x3-pmrf-67xvCGA-pvx5-r49h-qf56CGA-qpc4-vpqx-f239CGA-r4mw-f45r-753c
Published 08-06-2026Last modified 13-08-2026
Vulnerability summary
CVE-2026-9669 is a high (CVSS 8.2) Stack-based Buffer Overflow vulnerability in python software foundation cpython. EPSS estimates a 0.43% chance of exploitation in the next 30 days, higher than 35.6% of scored vulnerabilities.
CVSS score
8.2/10
010
High · v4.0 (CVE.org)EPSS score
0.43%
0%100%
Low · -0.25 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 19 · Related 15OPENSUSE-SU-2026:11181-1OPENSUSE-SU-2026:11747-1OPENSUSE-SU-2026:11748-1OPENSUSE-SU-2026:11756-1OPENSUSE-SU-2026:11757-1OPENSUSE-SU-2026:11817-1RHSA-2026:67572RHSA-2026:68132RHSA-2026:68135RHSA-2026:68154RHSA-2026:68309SUSE-SU-2026:23743-1SUSE-SU-2026:23845-1SUSE-SU-2026:4396-1SUSE-SU-2026:4401-1SUSE-SU-2026:4411-1SUSE-SU-2026:4534-1SUSE-SU-2026:4633-1USN-8509-1CGA-W7R7-76WJ-XG3R
Timeline
- 08-06-2026PublishedVulnerability first disclosed.
- 13-08-2026Last modifiedVulnerability information updated.
Description
bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.
CVSS metrics
7 scores · 7 sources · 1 versionHigh 8.2Preferred score · CVE.org (CNA)
CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:NSourcesAll 7 agree
- OSV · AlpineEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · UbuntuEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · DebianEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- OSV · WolfiEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- OSV · ChainguardEcosystem advisory · calculated8.2HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- NVDNIST8.2HighCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.43%
Chance of exploitation in the next 30 days
Percentile
36%
Versus all other CVEs
30-day change
-0.25 pp
From 0.68% on 19-09-2026
19-09-202619-10-2026
EPSS score0.43%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ubuntu12 products
- python2.7All versions (No fix recorded)
- python3.10< 3.10.12-1~22.04.16
- python3.11All versions (No fix recorded)
- python3.12< 3.12.3-1ubuntu0.15
- python3.13All versions (No fix recorded)
Chainguard5 products
- python-3.10< 3.10.21-r0
- python-3.11< 3.11.16-r1
- python-3.12< 3.12.14-r2
- python-3.13< 3.13.14-r0
- python-3.14< 3.14.6-r1
Wolfi5 products
- python-3.10< 3.10.21-r0
- python-3.11< 3.11.16-r1
- python-3.12< 3.12.14-r2
- python-3.13< 3.13.14-r0
- python-3.14< 3.14.6-r1
Debian3 products
- python3.11< 3.11.2-6+deb12u9
- python3.13< 3.13.5-2+deb13u3 | < 3.13.14-1
- python3.14< 3.14.6-1
Alpine1 product
- python3< 3.14.7-r0
Python software foundation1 product
- cpython< 3.10.21 | ≥ 3.11.0, < 3.11.16 | ≥ 3.12.0, < 3.12.14 | ≥ 3.13.0, < 3.13.14 | ≥ 3.14.0, < 3.14.6 | ≥ 3.15.0a1, < 3.15.0b3
6 vendors · 27 products
References
19 links- mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/Vendor AdvisoryREPORTAdvisory
Show all 19 references
- github.com/python/cpythonPACKAGE