bzip2 CVE-2026-42250

bzip2recover is a bundled utility within the bzip2 compression suite, designed to salvage data from damaged .bz2 archives by scanning for valid compressed blocks. The root cause is CWE-787 (Out-of-bounds Write): an off-by-one logic error causes the program to write one element past the intended boundary of a statically allocated global buffer when parsing a crafted input file. This class of error - common in file-parsing utilities with fixed-size internal state - results in memory corruption adjacent to the overwritten buffer. Because the affected buffer is global (not stack-allocated), the immediate consequence is typically a crash rather than a controllable code execution primitive, consistent with the observed denial-of-service impact. The CVSS 4.0 vector (AV:L/AC:L/AT:N) confirms low attack complexity with no prerequisite system configurations required beyond the ability to provide a file to the utility.