CVE-2026-122330: Blosc c-blosc2 before 3.5.0 Divide-by-Zero via blosc2_schunk_get_slice_buffer()
Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2schunkgetslicebuffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2schunkopen() or blosc2schunkfrombuffer() and read as a slice, raising SIGFPE and terminating the process.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using c-blosc2 versions before 3.5.0 are exposed if they open attacker-controlled Blosc2 frames through blosc2_schunk_open() or blosc2_schunk_from_buffer() and then read a slice with blosc2_schunk_get_slice_buffer().
What does an attacker need to do to trigger the crash?
An attacker needs to supply a crafted Blosc2 frame containing a zero chunksize or blocksize value. The application must process that frame and attempt to read it as a slice, which can raise SIGFPE and terminate the process.
Is this a confidentiality or integrity issue?
The provided impact is denial of service: the divide-by-zero condition can terminate the affected process. No confidentiality or integrity impact is stated.
What should teams do if they cannot immediately upgrade?
Avoid opening or slice-reading untrusted Blosc2 frames with the affected APIs until an upgrade is possible. In particular, prevent attacker-controlled frames with invalid zero chunksize or blocksize values from reaching blosc2_schunk_get_slice_buffer().