The flaw lies in Python’s bz2 module, where a BZ2Decompressor object can be reused after a decompression error. If an application catches the resulting OSError and retries with the same decompressor, carefully crafted input can cause the decompressor to resume from an invalid internal state and perform the decompressor to resume from an invalid internal state and perform out‑of‑bounds writes to a stack buffer. This produces a stack buffer overflow and out‑of-bounds write (CWE-121, CWE-787). The primary impact is a process crash, which equates to a denial of service, and it does not directly expose data or grant code execution, though repeated crashes could be leveraged in a more complex exploitation chain.

Python Software Foundation CPython. Specific affected versions are not listed in the CVE entry, so all releases in use until the fix is applied may be vulnerable.

The CVSS score is 8.2, indicating a severe risk. EPSS score is less than 1%, indicating a very low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers can exploit the weakness, a stack buffer overflow and out‑of‑bounds write (CWE-121, CWE-787), by delivering crafted BZ2 data to any Python application that reuses a BZ2Decompressor across errors. The likely attack vector is via untrusted input, which may be received over the network, file system, or any external data source. The vulnerability remains technically exploitable until the Python interpreter is upgraded to a version that includes the fix.