CVE-2011-4089: The bzexe command in bzip2 1.0.5 and earlier generates compressed executables that do not properly handle t...

Security readout for executives and security teams

This is a local-code-execution weakness in old bzip2 bzexe-generated executables. A local user could prepare a temporary directory so that, when a vulnerable compressed executable extracts, attacker-controlled code runs. The business risk is mainly shared Unix/Linux systems or privileged operational scripts that used bzexe. Exposure is most likely on legacy Unix/Linux hosts with bzip2 1.0.5 or earlier, especially where bzexe-compressed executables still exist and are run by other users or automation. Treat as a targeted legacy exposure issue, not an internet-wide emergency. Prioritize shared systems, administrative automation, and older Linux distributions where local user boundaries matter. Mitigation focus: Apply vendor bzip2 security updates where available.; Inventory and replace bzexe-generated executables from vulnerable bzip2 versions.; Avoid running legacy bzexe-compressed binaries in privileged workflows..

Prepared

Jun 14, 2026, 14:32 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.