The vulnerability in CPython's bz2.BZ2Decompressor occurs because the decompressor object can be reused after an OSError triggered by a decompression error. If an application catches this error and retries decompression with the same decompressor instance, specially crafted input may cause the decompressor to resume from an invalid internal state. This invalid state can lead to out-of-bounds writes on the stack, resulting in a buffer overflow (CWE-121). The CVSS 4.0 base score is 8.2, indicating high severity, with network attack vector, high attack complexity, and partial attack prerequisites.

Successful exploitation can cause the affected Python process to crash due to stack buffer overflow when processing maliciously crafted bz2 compressed data. There is no indication of code execution or privilege escalation in the provided data. The vulnerability affects applications using CPython's bz2 decompression functionality on untrusted input.

Patch status is not yet confirmed — check the Python Software Foundation advisory for current remediation guidance. Until an official fix is available, avoid reusing bz2.BZ2Decompressor objects after decompression errors when processing untrusted data to mitigate risk.