{"id":"CVE-2026-9669","aliases":[],"cve":{"records":[{"id":"CVE-2026-9669","source":"PSF","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-05-27T03:13:18.152Z","published":"2026-06-08T22:01:15.420Z","modified":"2026-11-10T12:40:42.674Z"}],"publishers":[{"name":"PSF","role":"CNA","organizationId":"28c92f92-d60d-412d-b760-e73465c3df22","modified":"2026-08-13T00:26:48.913Z"},{"name":"CVE","role":"ADP","organizationId":"af854a3a-2127-422b-91ae-364da2661108","modified":"2026-06-08T23:27:25.188Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-06-16T12:23:44.258Z"},{"name":"siemens-SADP","role":"ADP","organizationId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","modified":"2026-11-10T12:40:42.674Z"}],"references":[{"url":"https://github.com/python/cpython/pull/150600","tags":["patch"],"source":"PSF"},{"url":"https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/","tags":["vendor-advisory"],"source":"PSF"},{"url":"https://github.com/python/cpython/issues/150599","tags":["issue-tracking"],"source":"PSF"},{"url":"https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6","tags":["patch"],"source":"PSF"},{"url":"https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e","tags":["patch"],"source":"PSF"},{"url":"https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f","tags":["patch"],"source":"PSF"},{"url":"https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d","tags":["patch"],"source":"PSF"},{"url":"https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79","tags":["patch"],"source":"PSF"},{"url":"https://github.com/python/cpython/commit/991e6cf86496718c4ef00b362d640e00cb5c85b2","tags":["patch"],"source":"PSF"},{"url":"https://github.com/python/cpython/commit/1ba6135eae75ad8413413caeeedb56ae72320636","tags":["patch"],"source":"PSF"},{"url":"http://www.openwall.com/lists/oss-security/2026/06/08/17","tags":[],"source":"CVE"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html","tags":[],"source":"siemens-SADP"}],"weaknesses":[{"id":"CWE-121","description":"CWE-121 Stack-based buffer overflow","source":"PSF"}],"applicability":[],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-06-16T12:23:25.378543Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"bz2.BZ2Decompressor reuse after error can cause a stack buffer overflow","titleSource":"PSF","descriptionSource":"PSF","description":"bz2.BZ2Decompressor objects could be reused after a decompression error. If an application caught the resulting OSError and retried with the same decompressor, crafted input could cause the decompressor to resume from an invalid internal state and perform out-of-bounds writes to a stack buffer. This could crash the process when processing untrusted data.","score":8.2,"severity":"high","published":"2026-06-08T22:01:15.420Z","modified":"2026-11-10T12:40:42.674Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Python Software Foundation","name":"CPython","platforms":[],"versions":[{"version":"0","status":"affected","lessThan":"3.10.21","versionType":"python"},{"version":"3.11.0","status":"affected","lessThan":"3.11.16","versionType":"python"},{"version":"3.12.0","status":"affected","lessThan":"3.12.14","versionType":"python"},{"version":"3.13.0","status":"affected","lessThan":"3.13.14","versionType":"python"},{"version":"3.14.0","status":"affected","lessThan":"3.14.6","versionType":"python"},{"version":"3.15.0a1","status":"affected","lessThan":"3.15.0b3","versionType":"python"}],"defaultStatus":"unaffected","cpes":[],"source":"PSF","url":"https://www.cve.org/CVERecord?id=CVE-2026-9669"},{"vendor":"Siemens","name":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0)","platforms":[],"versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-9669"},{"vendor":"Siemens","name":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0)","platforms":[],"versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-9669"},{"vendor":"Siemens","name":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0)","platforms":[],"versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-9669"},{"vendor":"Siemens","name":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0)","platforms":[],"versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-9669"},{"vendor":"Siemens","name":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0)","platforms":[],"versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}],"defaultStatus":"unknown","cpes":[],"source":"siemens-SADP","url":"https://www.cve.org/CVERecord?id=CVE-2026-9669"}],"remediation":[],"references":["https://github.com/python/cpython/pull/150600","https://mail.python.org/archives/list/security-announce@python.org/thread/DBJZETMGUIFK7DVUWMOXHD3Z6IX2QPSX/","https://github.com/python/cpython/issues/150599","https://github.com/python/cpython/commit/157a5df8cb5d82b33f918a7489e72ce95ceb12b6","https://github.com/python/cpython/commit/5755d0f083949ff3c5bf3a37e673e24e306b036e","https://github.com/python/cpython/commit/619a12b2e545391dc436b3af79dda22337382a6f","https://github.com/python/cpython/commit/d3ca26983dfbccdf609f24ff5877dc3118e4702d","https://github.com/python/cpython/commit/938ec030e90c5e53f1faac6fab1643f14e4f4a79","https://github.com/python/cpython/commit/991e6cf86496718c4ef00b362d640e00cb5c85b2","https://github.com/python/cpython/commit/1ba6135eae75ad8413413caeeedb56ae72320636","http://www.openwall.com/lists/oss-security/2026/06/08/17","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"sources":[{"name":"CVE","id":"CVE-2026-9669","modified":"2026-11-10T12:40:42.674Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-9669"}],"assessments":[{"source":"PSF","vector":"CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.2}],"sourceAffected":[],"observedAt":"2026-11-10T12:49:24.086Z","kev":{"status":"not-listed","checkedAt":"2026-11-14T23:35:33.875Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"The bz2.BZ2Decompressor in Python's CPython, versions before 3.10.21, 3.11.16, 3.12.14, 3.13.14, and 3.14.6, has a stack buffer overflow weakness when reused after a decompression error, potentially crashing the process. An attacker with access to crafted input could exploit this. The impact is uncertain.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-11-10T15:16:27.351Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-9669"}]}}