AZL-112694: CVE-2026-122330 affecting package blosc 1.21.6-1

Q: What attacker access is needed to trigger this issue?

An attacker needs to cause the application to open an attacker-controlled Blosc2 frame through blosc2_schunk_open() or blosc2_schunk_from_buffer(), then have the application read a slice from that frame.

Q: What is the impact of successful exploitation?

A crafted frame with a zero chunksize or blocksize can cause a divide-by-zero condition in blosc2_schunk_get_slice_buffer(). This raises SIGFPE and terminates the affected application.

Q: How can I determine whether an application is exposed?

Applications are exposed if they use an affected c-blosc2 version before 3.5.0 and process untrusted Blosc2 frames through the affected open or buffer-loading APIs before reading slices. The listed package is azure-linux/blosc 1.21.6-1.

Published Nov 5, 2026

Updated

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2schunkgetslicebuffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2schunkopen() or blosc2schunkfrombuffer() and read as a slice, raising SIGFPE and terminating the process.

Affected Software

1 affected component

azure-linux/blosc<=1.21.6-1

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-122330

Frequently Asked Questions

What attacker access is needed to trigger this issue?

An attacker needs to cause the application to open an attacker-controlled Blosc2 frame through blosc2_schunk_open() or blosc2_schunk_from_buffer(), then have the application read a slice from that frame.

What is the impact of successful exploitation?

A crafted frame with a zero chunksize or blocksize can cause a divide-by-zero condition in blosc2_schunk_get_slice_buffer(). This raises SIGFPE and terminates the affected application.

How can I determine whether an application is exposed?

Applications are exposed if they use an affected c-blosc2 version before 3.5.0 and process untrusted Blosc2 frames through the affected open or buffer-loading APIs before reading slices. The listed package is azure-linux/blosc 1.21.6-1.

AZL-112694: CVE-2026-122330 affecting package blosc 1.21.6-1

Affected Software

Child vulnerabilities

Frequently Asked Questions

What attacker access is needed to trigger this issue?

What is the impact of successful exploitation?

How can I determine whether an application is exposed?

Company

Resources

Contact

Frequently Asked Questions

What attacker access is needed to trigger this issue?

What is the impact of successful exploitation?

How can I determine whether an application is exposed?