CVE-2026-42250 is an off-by-one error vulnerability in the bzip2recover utility within bzip2, affecting Red Hat Hardened Images RPMs. The flaw allows a local attacker to cause an out-of-bounds write to a global buffer by processing a specially crafted compressed file, leading to memory corruption and a denial of service (application crash). Exploitation requires local user interaction with a malicious file. Red Hat has published updated RPM packages including bzip2-1.0.8-23.2.hum1 for aarch64 and x86_64 architectures, but no fix is currently provided for this vulnerability in these packages. Mitigation options are either unavailable or do not meet Red Hat's standards for deployment and stability.

The vulnerability allows a local attacker to cause a denial of service by crashing the bzip2recover utility through an out-of-bounds write triggered by a specially crafted file. There is no impact on confidentiality or integrity reported. The attack vector is local with low complexity but requires user interaction. No known exploits are reported in the wild. The impact is limited to denial of service conditions.

Currently, no official fix or patch is available for this vulnerability in the affected Red Hat Hardened Images RPMs. Red Hat states that mitigation options either do not exist or do not meet their criteria for ease of use, applicability, or stability. Users should avoid processing untrusted bzip2 archives with the bzip2recover utility until a fix is released. Monitor Red Hat advisories for updates and apply patches once available.