CVE-2026-103222: Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflow
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclzdecompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Blosc C-Blosc2to a version that resolves this vulnerability.Fixed in 3.3.3Patch fe2964d114d97847f56570a0ab2be2c57ccbeedc
Event History
Frequently Asked Questions
Which deployments are affected?
C-Blosc2 versions up to and including 3.3.2 are affected when they use the blosclz decompression component. Version 3.3.3 contains the fix.
What would an attacker need to exploit this issue?
The attack can be launched remotely and requires no privileges or user interaction. Exploitation is considered difficult because it has high attack complexity and requires crafted manipulation reaching blosclz_decompress.
What should teams do if they cannot upgrade immediately?
The provided data identifies upgrading the affected component to C-Blosc2 3.3.3 as the remediation. No alternative mitigation or workaround is specified.
How can I identify the relevant fix?
The fix is identified by patch commit fe2964d114d97847f56570a0ab2be2c57ccbeedc. Verify that deployed C-Blosc2 packages are updated to version 3.3.3 or include that patch.