CVE-2026-9669 describes a stack-based buffer overflow in the bz2.BZ2Decompressor component of CPython. The issue arises when a decompression error triggers an OSError, and the application retries decompression with the same decompressor object. Crafted input can cause the decompressor to continue from an invalid internal state, resulting in out-of-bounds writes to a stack buffer. This vulnerability can cause process crashes when processing untrusted data. The CVSS 4.0 base score is 8.2, indicating high severity. No official patch or remediation level has been published by the Python Software Foundation as of the provided data.

The vulnerability can cause a stack-based buffer overflow leading to out-of-bounds memory writes. This may result in a denial of service via process crash when processing specially crafted untrusted input. There is no indication of code execution or privilege escalation from the provided data. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until a fix is available, avoid reusing the same bz2.BZ2Decompressor object after a decompression error, especially when processing untrusted data. Applications should create a new decompressor instance for each decompression attempt to prevent resuming from an invalid internal state.