Divide-By-Zero Vulnerability in Blosc c-blosc2 Affects Multiple Applications
CVE-2026-122330
6.8MEDIUM
What is CVE-2026-122330?
The c-blosc2 library, specifically versions prior to 3.5.0, is vulnerable to a divide-by-zero error when certain conditions are met. The vulnerability occurs in the blosc2_schunk_get_slice_buffer() function if an attacker provides malformed frames with unchecked values for chunksize or blocksize. This can allow attackers to crash applications unexpectedly. By exploiting this vulnerability, an attacker can feed malicious Blosc2 frames to functions such as blosc2_schunk_open() or blosc2_schunk_from_buffer(), triggering a SIGFPE signal which leads to process termination. Updating to version 3.5.0 or later is strongly advised to mitigate this risk.
Affected Version(s)
c-blosc2 0 < 3.5.0
References
CVSS V4
Score:
6.8
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown
Timeline
Vulnerability published
Vulnerability Reserved
Credit
HaiND from the Post and Telecommunication Institute of Technology
Francesc Alted