ZDI-26-624: Backblaze Personal Computer Backup bzbackup Link Following Denial-of-Service Vulnerability
ZDI disclosed CVE-2026-19820, a CVSS 6.1 local link-following denial-of-service flaw in the bzbackup component of Backblaze Personal Computer Backup.
The Zero Day Initiative published advisory ZDI-26-624 for a denial-of-service vulnerability in Backblaze Personal Computer Backup's bzbackup component. A local attacker must first gain the ability to run low-privileged code on the target system to trigger the link-following flaw. ZDI rated the issue CVSS 6.1 and assigned CVE-2026-19820.
- Local attackers with low-privileged code execution can cause a denial-of-service condition.
- The flaw involves link following in the bzbackup component.
- ZDI assigned CVSS 6.1 under CVE-2026-19820.
- CVEs
- CVE-2026-19820
- Vendors
- Backblaze
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19820 | Unbootable-System Denial of Service via Link Following in Backblaze Windows Backup Client | 7.8 | <1% |
From the original article
This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Backblaze Personal Computer Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.