CVE-2026-103222

Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflow

View on CVE.org
Published Sep 30, 2026 CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed
Description
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.

Analysis

AI-generated

Technical impact

The Blosc C-Blosc2 library contains an integer overflow flaw in the blosclz_decompress function. Maliciously crafted compressed data can cause an overflow in internal size counters, which could in turn lead to memory corruption or, in the worst case, arbitrary code execution. The vulnerability is specifically identified as CWE‑189 and CWE‑190 and is triggered by improper handling of compressed data sizes.

Affected Systems

All implementations of Blosc C‑Blosc2 released up to and including version 3.3.2 that use the blosclz_decompress routine are affected. Upgrades to version 3.3.3 or later contain the fix and are required to remove the flaw.

Risk and Exploitability

The CVSS base score of 6.3 indicates moderate severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, suggesting it is not widely exploited yet. The description notes that the attack can be launched remotely, requires high complexity, and is difficult to exploit, implying a lower likelihood of real‑world exploitation at this time.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade the Blosc C‑Blosc2 library to version 3.3.3 or newer to eliminate the integer overflow flaw.
  • If an upgrade is temporarily infeasible, add validation to the blosclz_decompress input path to reject corrupted or excessively large payloads and enforce strict decompression size limits.
  • Deploy network controls or monitoring to restrict external access to services that invoke blosclz_decompress and watch for anomalous decompression activity.

Generated by OpenCVE AI on September 30, 2026 at 17:02 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
Description A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.
Title Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflow
First Time appeared Blosc
Blosc c-blosc2
Weaknesses CWE-189
CWE-190
CPEs cpe:2.3:a:blosc:c-blosc2:*:*:*:*:*:*:*:*
Vendors & Products Blosc
Blosc c-blosc2
References
Metrics cvssV2_0

{'score': 5.1, 'vector': 'AV:N/AC:H/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C'}

cvssV3_0

{'score': 5.6, 'vector': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV3_1

{'score': 5.6, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C'}

cvssV4_0

{'score': 6.3, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X'}
Weaknesses

Sources

Status
PUBLISHED
Assigner
VulDB
Published
Updated
Sep 30, 2026, 4:26 PM
Reserved
Sep 30, 2026, 7:25 AM

View source JSON

Updated
Sep 30, 2026, 4:26 PM

JSON

Status
Deferred
Published
Sep 30, 2026, 3:22 PM
Modified
Sep 30, 2026, 5:16 PM

View source JSON

No data.

Updated
Sep 30, 2026, 7:00 PM

JSON