p PatchFirst

CVE-2026-42250

CVE-2026-42250 · Off-by-One Leading to Out-of-Bounds Write in bzip2

This page contains facts from public vulnerability sources. Check the original advisory before updating.

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service). This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67

CVSS 4.8 · Medium · EPSS 0.1% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • bzip2

    Versions
    • ≥ 0, ≤ 1.0.8: Affected (semver)
    • 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67: Not affected (custom)

    No fix published

  • bzip2 Debian:12

    Versions
    • 1.0.8-5
    • 1.0.8-5.1
    • 1.0.8-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bzip2 Debian:13

    Versions
    • 1.0.8-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bzip2 Debian:14

    Versions
    • 1.0.8-6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bzip2 Ubuntu:Pro:14.04:LTS

    Versions
    • 1.0.6-4
    • 1.0.6-5
    • 1.0.6-5ubuntu0.1~esm1
    • 1.0.6-5ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: < 1.0.6-5ubuntu0.1~esm3

    Update to 1.0.6-5ubuntu0.1~esm3

  • bzip2 Ubuntu:Pro:16.04:LTS

    Versions
    • 1.0.6-8
    • 1.0.6-8ubuntu0.1
    • 1.0.6-8ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 1.0.6-8ubuntu0.2+esm1

    Update to 1.0.6-8ubuntu0.2+esm1

  • bzip2 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.0.6-8.1
    • 1.0.6-8.1ubuntu0.1
    • 1.0.6-8.1ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 1.0.6-8.1ubuntu0.2+esm1

    Update to 1.0.6-8.1ubuntu0.2+esm1

  • bzip2 Ubuntu:Pro:20.04:LTS

    Versions
    • 1.0.6-9.2
    • 1.0.8-2
    Affected ranges
    • ECOSYSTEM: < 1.0.8-2ubuntu0.1~esm1

    Update to 1.0.8-2ubuntu0.1~esm1

  • bzip2 Ubuntu:22.04:LTS

    Versions
    • 1.0.8-4ubuntu3
    • 1.0.8-4ubuntu4
    • 1.0.8-5
    • 1.0.8-5build1
    Affected ranges
    • ECOSYSTEM: < 1.0.8-5ubuntu0.1

    Update to 1.0.8-5ubuntu0.1

  • bzip2 Ubuntu:24.04:LTS

    Versions
    • 1.0.8-5build1
    • 1.0.8-5ubuntu1
    • 1.0.8-5.1
    • 1.0.8-5.1build0.1
    Affected ranges
    • ECOSYSTEM: < 1.0.8-5.1ubuntu0.1

    Update to 1.0.8-5.1ubuntu0.1

  • bzip2 Ubuntu:25.10

    Versions
    • 1.0.8-6
    • 1.0.8-6build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bzip2 Ubuntu:26.10

    Versions
    • 1.0.8-6build2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • bzip2 Ubuntu:26.04:LTS

    Versions
    • 1.0.8-6build1
    • 1.0.8-6build2
    Affected ranges
    • ECOSYSTEM: < 1.0.8-6ubuntu0.1

    Update to 1.0.8-6ubuntu0.1

Original sources

Check your server →