CVE-2026-103222
Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflow
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflow
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.
- Record
CVE-2026-103222- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C - CVSS 3.0
- 5.6 Medium
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L/E:X/RL:O/RC:C - CVSS 2.0
- 5.1
AV:N/AC:H/Au:N/C:P/I:P/A:P/E:ND/RL:OF/RC:C - Weakness
- CWE-190, CWE-189
- Updated
- 2026-11-02
EUVDEUVD-2026-89956
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.
- Record
EUVD-2026-89956- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c776-5v2h-x5j5
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function...
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.
- Record
GHSA-c776-5v2h-x5j5- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
NVD
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.
- Record
CVE-2026-103222- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - CVSS 2.0
- 5.1 Medium
AV:N/AC:H/Au:N/C:P/I:P/A:P - Weakness
- CWE-189, CWE-190
- Updated
- 2026-11-02
OSV
Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflow
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.
- Record
CVE-2026-103222- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X - Weakness
- CWE-189, CWE-190
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2026-103222
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.
- Record
DEBIAN-CVE-2026-103222- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-103222
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.
- Record
UBUNTU-CVE-2026-103222- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N - CVSS 3.1
- 5.6 Medium
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
c-blosc2Debian:13 |
All versions, plus listed versions 2.17.1+ds-12.17.1+ds-22.22.0+ds-12.22.0+ds-1~exp12.23.0+ds-1 Show 8 moreShow less2.23.0+ds-1~exp12.23.0+ds-1~exp22.23.1+ds-12.23.1+ds-23.1.5-1~exp13.2.3-1~exp13.3.5-13.3.5-1~exp1 |
None known |
c-blosc2Debian:14 |
before 3.3.5-1, plus listed versions 2.17.1+ds-12.17.1+ds-22.22.0+ds-12.22.0+ds-1~exp12.23.0+ds-1 Show 7 moreShow less2.23.0+ds-1~exp12.23.0+ds-1~exp22.23.1+ds-12.23.1+ds-23.1.5-1~exp13.2.3-1~exp13.3.5-1~exp1 |
3.3.5-1 |
c-blosc2Ubuntu:24.04:LTS |
All versions, plus listed versions 2.12.0+ds-12.12.0+ds-22.13.1+ds-12.13.1+ds-1ubuntu12.13.1+ds-1.1ubuntu12.13.1+ds-1.1ubuntu2 |
None known |
c-blosc2Ubuntu:26.10 |
All versions, plus listed versions 2.23.0+ds-12.23.1+ds-12.23.1+ds-2 |
None known |
c-blosc2Ubuntu:26.04:LTS |
All versions, plus listed versions 2.17.1+ds-22.22.0+ds-12.23.0+ds-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-103222 is a medium vulnerability (CVSS 6.3) in Blosc C-blosc2, published September 30, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.28%, the 20th percentile. Fixed in c-blosc2 3.3.5-1.
References
vuldb.com/vuln/411905
github.com/Blosc/c-blosc2/commit/fe2964d114d97847f56570a0ab2be2c57ccbeedc
Show 7 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-103222
security-tracker.debian.org/tracker/CVE-2026-103222
ubuntu.com/security/CVE-2026-103222
cve.org/CVERecord?id=CVE-2026-103222