debian/c-blosc2 vulnerabilities

Latest debian/c-blosc2 CVEs

Newest publication first

1. CVE-2026-122330 Blosc c-blosc2 before 3.5.0 Divide-by-Zero via blosc2_schunk_get_slice_buffer()

   Published 2026-11-05

   Medium·CVSS 6.8 EPSS 0.24%

   Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious B...

2. CVE-2026-103222 Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflow

   Published 2026-09-30

   Medium·CVSS 6.3 EPSS 0.28%

   A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high comple...

3. CVE-2025-29476 Buffer Overflow vulnerability in compress_chunk_fuzzer with oss-fuzz on commit 16450518afddcb3139de627157208e49bfef6987 in c-blosc2 v.2.17.0 and before.

   Published 2025-04-04

   Medium·CVSS 5.5 EPSS 0.25%

   Buffer Overflow vulnerability in compress_chunk_fuzzer with oss-fuzz on commit 16450518afddcb3139de627157208e49bfef6987 in c-blosc2 v.2.17.0 and before.

4. CVE-2024-3204 c-blosc2 ndlz4x4.c ndlz4_decompress heap-based overflow

   Published 2024-04-02

   Critical·CVSS 9.8 EPSS 1.3%

   A vulnerability has been found in c-blosc2 up to 2.13.2 and classified as critical. Affected by this vulnerability is the function ndlz4_decompress of the file /src/c-blosc2/plugins/codecs/ndlz/ndlz4x4.c. The manipulation leads to heap-based buffer overflow. The attack can be lau...

5. CVE-2024-3203 c-blosc2 ndlz8x8.c ndlz8_decompress heap-based overflow

   Published 2024-04-02

   Critical·CVSS 9.8 EPSS 1.4%

   A vulnerability, which was classified as critical, was found in c-blosc2 up to 2.13.2. Affected is the function ndlz8_decompress of the file /src/c-blosc2/plugins/codecs/ndlz/ndlz8x8.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remo...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.