CVE-2011-4089

CVE-2011-4089 describes a local arbitrary code execution vulnerability in bzip2 versions 1.0.5 and earlier, specifically within the bzexe command. This flaw arises from improper handling of temporary files during compressed executable extraction, allowing a local attacker to precreate a temporary directory to execute arbitrary code. With a CVSS score of 4.6 (AV:L/AC:L/Au:N/C:P/I:P/A:P), it indicates low attack complexity and requires local access, potentially leading to partial confidentiality, integrity, and availability compromise. While not listed on the KEV catalog and lacking Metasploit/Nuclei modules, an ExploitDB entry (EDB-18147) exists, suggesting proof-of-concept code is available, though there is no evidence of active exploitation or significant community discussion.