UBUNTU-CVE-2026-122330: Ubuntu/c-blosc2 vulnerability

Published Nov 6, 2026

Updated

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2schunkgetslicebuffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2schunkopen() or blosc2schunkfrombuffer() and read as a slice, raising SIGFPE and terminating the process.

Affected Software

3 affected components

ubuntu/c-blosc2*

Event History

Nov 6, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

What applications are exposed to this issue?

Applications are exposed if they use c-blosc2 before 3.5.0 and open attacker-controlled Blosc2 frames through blosc2_schunk_open() or blosc2_schunk_from_buffer(), then read data as a slice.

What must an attacker provide to trigger the crash?

An attacker needs to supply a crafted Blosc2 frame with a zero chunksize or blocksize value. Processing a slice from that frame can cause a divide-by-zero SIGFPE and terminate the application.

How can teams determine whether they may be affected?

Review whether the application accepts or processes untrusted Blosc2 frames and whether those frames are opened with blosc2_schunk_open() or blosc2_schunk_from_buffer() before slice reads. Also verify whether the deployed c-blosc2 version is earlier than 3.5.0.

UBUNTU-CVE-2026-122330: Ubuntu/c-blosc2 vulnerability

Affected Software

Event History

Frequently Asked Questions

What applications are exposed to this issue?

What must an attacker provide to trigger the crash?

How can teams determine whether they may be affected?

Company

Resources

Contact

Frequently Asked Questions

What applications are exposed to this issue?

What must an attacker provide to trigger the crash?

How can teams determine whether they may be affected?