bzip2recover utility contains an off-by-one vulnerability (CVE-2026-42250) allowing…
bzip2recover utility contains an off-by-one vulnerability (CVE-2026-42250) allowing denial of service via crafted files; patch available.
CERT Polska coordinated disclosure of CVE-2026-42250, an off-by-one error in the bzip2recover utility. When processing a specially crafted file, the vulnerability triggers an out-of-bounds write to a global buffer, leading to memory corruption and application crash. This results in a denial-of-service condition. The issue has been addressed in bzip2 patch 35d122a3df8b0cc4082a4d89fdc6ee99f375fe67.
The vulnerability was responsibly reported by researchers Michał Majchrowicz and Marcin Wyczechowski from AFINE Team. Organizations using bzip2, particularly the bzip2recover utility for file recovery operations, should apply the available patch to mitigate potential denial-of-service risks.
While the vulnerability requires processing of a malicious file, the widespread use of bzip2 in compression workflows across various industries warrants attention. The primary impact is availability disruption rather than data compromise or system compromise.
Mentioned in this report
Detection guidance
Repeated Crash of bzip2recover Process (Possible CVE-2026-42250 Exploitation Attempt)
Detects Windows Error Reporting / Application Error events for bzip2recover.exe, which may indicate exploitation attempts against the off-by-one out-of-bounds write vulnerability (CVE-2026-42250) causing memory corruption and crash. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Repeated Crash of bzip2recover Process (Possible CVE-2026-42250 Exploitation
Attempt)
id: f7c72542-a415-5134-bc47-a2a7ed4a0f57
status: experimental
description: 'Detects application crash events for bzip2recover.exe. CVE-2026-42250
is an off-by-one
out-of-bounds write in bzip2recover triggered by processing a specially crafted
file,
resulting in memory corruption and a denial-of-service crash. Multiple crash events
for
this process from the same host in a short time window may indicate repeated exploitation
attempts against this vulnerability; a single crash may simply be benign corruption
handling.
'
references:
- CVE-2026-42250
author: Vorant
logsource:
product: windows
service: application
category: application_crash
detection:
selection:
Image|endswith: \bzip2recover.exe
condition: selection
fields:
- Image
- ExceptionCode
- FaultingModule
- Computer
falsepositives:
- Legitimate corrupted or truncated bzip2 archives being processed for recovery, unrelated
to exploitation
- Disk or storage errors causing file corruption during normal recovery workflows
level: low
tags:
- attack.impact
- attack.t1499
- cve.2026.42250
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-42250
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free