ZDI publishes five advisories for one CVE-2026-19820 local denial-of-service flaw across five Backblaze Personal Computer Backup components

On 2026-09-09, the Zero Day Initiative published five advisories (ZDI-26-624 through ZDI-26-628), all mapped to CVE-2026-19820 (CVSS 6.1), a local link-following denial-of-service vulnerability affecting the bzbackup, bzserv, bzfilelist, bztransmit, and…

The Zero Day Initiative published five separate advisories on the same day (2026-09-09), each describing a link-following denial-of-service condition in a different component of Backblaze Personal Computer Backup: ZDI-26-624 (bzbackup), ZDI-26-625 (bzserv), ZDI-26-626 (bzfilelist), ZDI-26-627 (bztransmit), and ZDI-26-628 (bzreports). All five advisories are tracked under the single CVE identifier CVE-2026-19820 and carry the same CVSS score of 6.1. In every case, a local attacker must first gain the ability to execute low-privileged code on the target system before triggering the denial-of-service condition via link following. All five source reports are consistent on the CVE identifier, CVSS score, local attack vector, and low-privilege prerequisite; they differ only in which product component each advisory covers. The reports do not state patched versions, fixed releases, vendor statements, or remediation guidance.