AIKIDO-2026-235619
bzip2 is vulnerable to Out-of-bounds Write
48
CVE Score
Medium
Out-of-bounds Write
TL;DR
Affected versions of bzip2 have an off-by-one error in the bzip2recover utility's block-boundary scanner. A crafted file with more than 50,000 copies of the 48-bit bzip2 block-header magic writes one element past the global bStart/bEnd buffers, corrupting memory and crashing the process.
How do I fix this?
There is no patched release yet. Upgrade bzip2 once a version newer than 1.0.8 is published, or apply this patch. Until then, do not run bzip2recover on untrusted files.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and you run the bzip2recover utility on untrusted or damaged .bz2 files.
Package
bzip2Versions
0.0.1 - 1.0.8
No fix availableBackground info
bzip2 is vulnerable to Out-of-bounds Write in versions 0.0.1 - 1.0.8.
Links
sourceware.org/cgit/bzip2/commit/?id=35d122a3df8b0cc4082a4d89fdc6ee99f375fe67cert.pl/en/posts/2026/05/CVE-2026-42250/inbox.sourceware.org/bzip2-devel/20260528145407.293768-1-mark@klomp.org/sourceware.org/bzip2/
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.