Is CVE-2026-42250 actively exploited?

No active exploitation of CVE-2026-42250 has been confirmed so far. Continue monitoring, as exploit status can change.

Can CVE-2026-42250 be exploited remotely?

No. CVE-2026-42250 requires local access to exploit.

What is the CVSS score of CVE-2026-42250?

CVE-2026-42250 has a CVSS score of 5.1 (MEDIUM).

HOME VULNERABILITIESCVE-2026-42250

MEDIUM

CVE-2026-42250

CWE-787Published: May 28, 2026· Updated: May 28, 2026

5.1

CVSS v3.1

EPSS:0.02%probability of exploitation in 30 daysPercentile:4.0th

Official Description

bzip2 contains an off‑by‑one error in the bzip2recover utility. When processing a specially crafted file, the application performs an out‑of‑bounds write to a global buffer, resulting in memory corruption and a crash (denial of service).

This issue was fixed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67

NVD Source

Technical Analysis

CVE-2026-42250 requires local access, meaning attackers must already have a foothold on the target system.

The vulnerability requires no privileges and no user interaction, making it a prime target for automated exploitation campaigns and worm-like propagation.

From a weakness classification perspective (CWE-787): Out-of-bounds write vulnerabilities can lead to data corruption, crashes, or arbitrary code execution.

CVSS v3.1 Vector Breakdown

Exploitability

Attack VectorLocal

Attack ComplexityLow

Privileges Req.None

User InteractionNone

ScopeX

Impact

Confidentiality

Integrity

Availability

CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X