CVE-2010-0405: Bzip BZIP2

Medium severity, CVSS 5.1. EPSS: 3.3% chance of exploitation in the next 30 days.

Integer overflow in the BZ2_decompress function in decompress.c in bzip2 and libbzip2 before 1.0.6 allows context-dependent attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted compressed file.

Affected products

• Bzip BZIP2: up to and including 1.0.5; version 0.9 only; version 0.9.0 only; version 0.9.0a only; version 0.9.0b only; version 0.9.0c only; …
• LIBZIP2 LIBZIP2: up to and including 1.0.5

Published 2010-09-28. Last modified 2026-06-16.