CVE-2026-42250

A flaw was found in bzip2. The bzip2recover utility contains an off-by-one error that allows a local attacker to cause an out-of-bounds write to a global buffer by processing a specially crafted file. This memory corruption can lead to a crash, resulting in a Denial of Service (DoS).

A Moderate impact denial of service flaw exists in the bzip2recover utility within bzip2. This vulnerability allows a local attacker to trigger an out-of-bounds write and crash the application by processing a specially crafted compressed file. Exploitation requires user interaction with a malicious file, limiting the attack vector to scenarios where untrusted bzip2 archives are processed by the recovery utility.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.