The vulnerability is a divide-by-zero flaw in the function blosc2_schunk_get_slice_buffer() of Blosc’s c-blosc2 library. An attacker can construct a Blosc2 frame with a chunk size or block size of zero, feed it into blosc2_schunk_open() or blosc2_schunk_from_buffer(), then request a slice. The library will perform a division by the zero value, raising a floating point exception (SIGFPE) and causing the application to terminate. This results in a denial‑of‑service condition for the affected process.

Products affected are the Blosc c-blosc2 library, any software that links against it and processes user‑supplied Blosc2 frames. The vulnerability exists in all versions prior to 3.5.0, including the 3.4.1 release line. Any system using an unpatched c‑blosc2 library is at risk if it consumes potentially malicious Blosc frames.

The CVSS score of 6.8 indicates a medium severity. No public exploitation evidence or KEV listing exists, and EPSS data is unavailable, so the quantified likelihood is unknown. However, the flaw requires only a crafted Blosc frame and does not need special privileges or network access if the application processes external data. The threat manifests as a crash, which can be leveraged by an attacker to disrupt services or create a vector for further exploitation in a compromised process.