ZDI-26-625: Backblaze Personal Computer Backup bzserv Link Following Denial-of-Service Vulnerability
ZDI disclosed CVE-2026-19820, a CVSS 6.1 local link-following denial-of-service flaw in the bzserv component of Backblaze Personal Computer Backup.
The Zero Day Initiative published advisory ZDI-26-625 for a denial-of-service vulnerability in Backblaze Personal Computer Backup's bzserv component. A local attacker must already be able to execute low-privileged code on the system to trigger the flaw, which involves link following. ZDI assigned a CVSS score of 6.1 and the CVE identifier CVE-2026-19820.
- Local attackers with low-privileged code execution can cause a denial-of-service condition.
- The flaw involves link following in the bzserv backup component.
- ZDI assigned CVSS 6.1 under CVE-2026-19820.
- CVEs
- CVE-2026-19820
- Vendors
- Backblaze
- Organizations
- Zero Day Initiative
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19820 | Unbootable-System Denial of Service via Link Following in Backblaze Windows Backup Client | 7.8 | <1% |
From the original article
This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Backblaze Personal Computer Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.
zerodayinitiative.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.