The Blosc C-Blosc2 library contains an integer overflow flaw in the blosclz_decompress function. Maliciously crafted compressed data can cause an overflow in internal size counters, which could in turn lead to memory corruption or, in the worst case, arbitrary code execution. The vulnerability is specifically identified as CWE‑189 and CWE‑190 and is triggered by improper handling of compressed data sizes.

All implementations of Blosc C‑Blosc2 released up to and including version 3.3.2 that use the blosclz_decompress routine are affected. Upgrades to version 3.3.3 or later contain the fix and are required to remove the flaw.

The CVSS base score of 6.3 indicates moderate severity. No EPSS score is available, and the flaw is not listed in the CISA KEV catalog, suggesting it is not widely exploited yet. The description notes that the attack can be launched remotely, requires high complexity, and is difficult to exploit, implying a lower likelihood of real‑world exploitation at this time.