# CVE-2026-9669: Python CPython stack buffer overflow in bz2.BZ2Decompressor reuse

Source: https://junglewise.ai/threats/cve-2026-9669-python-cpython-stack-buffer-overflow-in-bz2-bz2decompressor-reuse  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-08. Updated: 2026-06-08  
License: CC BY 4.0 with a link back

CVE-2026-9669 · Severity: info · CVSS 8.2 · Published 2026-06-08

A vulnerability exists in Python's bz2 compression library, which is used by many applications to handle compressed data. If an application encounters an error while decompressing a file and attempts to reuse the same decompressor object, it could lead to a system crash. This could allow an attacker to disrupt services or cause applications to fail by providing specially crafted compressed files.

Technologies: [Python Software Foundation CPython](https://junglewise.ai/threats/technologies/cpython). Vendors: [Python Software Foundation](https://junglewise.ai/threats/vendors/python-software-foundation).

## Quick answers

**Is CVE-2026-9669 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9669 being exploited in the wild.

**How severe is CVE-2026-9669?** Informational severity, with a CVSS score of 8.2, published 8 June 2026.

**Which products and versions are affected?** Python Software Foundation CPython 3.12, 3.13, 3.14, 3.15 (main).

**Is there a fix for CVE-2026-9669?** A patch was published on 2026-06-07: Fix merged into CPython main branch Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9669 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9669?** Check whether you run Python Software Foundation CPython at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack-based buffer overflow (CWE-121) exists in the CPython bz2 module. The vulnerability occurs when a bz2.BZ2Decompressor object is reused after it has already raised an OSError during a previous decompression attempt. If an application catches the exception and retries decompression with the same object, crafted input can cause the underlying libbz2 state to become desynchronized, resulting in out-of-bounds writes to a stack buffer. This typically results in a hard crash of the Python interpreter. The issue has been addressed by preventing the reuse of decompressor objects once they have entered an error state.

## Affected products

- Python Software Foundation CPython 3.12, 3.13, 3.14, 3.15 (main)

## Timeline

- 2026-05-30: disclosed: Issue reported on GitHub
- 2026-06-07: patched: Fix merged into CPython main branch
- 2026-06-08: advisory: CVE published and NVD record created

## References

- [https://github.com/python/cpython/issues/150599](https://github.com/python/cpython/issues/150599)
- [https://github.com/python/cpython/pull/150600](https://github.com/python/cpython/pull/150600)
- [https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/](https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/)

## Related threats

- [Python gzip/tarfile/zipfile CLI module shadowing via sys.path](https://junglewise.ai/threats/cve-2026-115791-when-tarfile-or-zipfile-command-line-interface-cli-is-used-to)
- [Python CPython quadratic complexity in xml.etree XPath index predicates](https://junglewise.ai/threats/cve-2026-6879-python-cpython-quadratic-complexity-in-xml-etree-xpath-index)
- [Python CPython CPU denial of service in html.parser.HTMLParser](https://junglewise.ai/threats/cve-2026-15308-python-cpython-cpu-denial-of-service-in-html-parser-htmlparser)
- [Python CPython improper permission preservation in tarfile.extract](https://junglewise.ai/threats/cve-2026-4360-python-cpython-improper-permission-preservation-in-tarfile-extract)
- [Python CPython infinite loop in tarfile streaming mode](https://junglewise.ai/threats/cve-2026-11972-python-cpython-infinite-loop-in-tarfile-streaming-mode)