ZDI 2026-09-09

ZDI-26-628: Backblaze Personal Computer Backup bzreports Link Following Denial-of-Service Vulnerability

CVE-2026-19820 +4

Machine-generated analysis · WAYSCloud LLM

A local attacker with low-privileged code can cause a denial-of-service in Backblaze Personal Computer Backup.

Context

The advisory concerns Backblaze Personal Computer Backup, specifically the bzreports component. It describes a denial-of-service condition that requires the attacker to execute low-privileged code on the host. The advisory assigns a CVSS v3.1 base score of 6.1 (CVE-2026-19820).

Operator considerations

Check: Verify the installed version of Backblaze Personal Computer Backup and whether the bzreports module is present.
Log: Record any crashes or unexpected termination of the bzreports process.

From Zero Day Initiative ↗

This vulnerability allows local attackers to create a denial-of-service condition on affected installations of Backblaze Personal Computer Backup. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The ZDI has assigned a CVSS rating of 6.1. The following CVEs are assigned: CVE-2026-19820.

Read the full advisory on ZDI →