Every CVE Search/ Get API key

CVE-2026-122330

Blosc c-blosc2 before 3.5.0 Divide-by-Zero via blosc2_schunk_get_slice_buffer()

6.8 Medium

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
None
User interaction
Passive

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.24%Unchanged since Nov 6, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.8

Blosc c-blosc2 before 3.5.0 Divide-by-Zero via blosc2_schunk_get_slice_buffer()

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.

Record
CVE-2026-122330
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-369
Updated
2026-11-05
EUVDEUVD-2026-117538 6.8

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.

Record
EUVD-2026-117538
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated
2026-11-05
GitHub AdvisoriesGHSA-99fx-294r-j6xw 6.8

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in...

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.

Record
GHSA-99fx-294r-j6xw
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-369
Updated
2026-11-05
NVD 6.8

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.

Record
CVE-2026-122330
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Weakness
CWE-369
Updated
2026-11-05
OSV 6.8

Blosc c-blosc2 before 3.5.0 Divide-by-Zero via blosc2_schunk_get_slice_buffer()

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.

Record
CVE-2026-122330
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness
CWE-369
Updated
2026-11-07
OSVDEBIAN-CVE-2026-122330 6.8

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.

Record
DEBIAN-CVE-2026-122330
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-07
OSVUBUNTU-CVE-2026-122330 6.8

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.

Record
UBUNTU-CVE-2026-122330
CVSS 4.0
6.8 MediumCVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
Updated
2026-11-07
OSVAZL-112694 No score

CVE-2026-122330 affecting package blosc 1.21.6-1

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.

Record
AZL-112694
Updated
2026-11-06

Affected products

Affected packages

Affected packages
PackageAffectedFixed
blosc
Azure Linux:3
 through 1.21.6-1 None known
c-blosc2
Debian:13
 All versions, plus listed versions
2.17.1+ds-12.17.1+ds-22.22.0+ds-12.22.0+ds-1~exp12.23.0+ds-1
Show 9 moreShow less
2.23.0+ds-1~exp12.23.0+ds-1~exp22.23.1+ds-12.23.1+ds-23.1.5-1~exp13.2.3-1~exp13.3.5-13.3.5-1~exp13.4.1-1
 None known
c-blosc2
Debian:14
 All versions, plus listed versions
2.17.1+ds-12.17.1+ds-22.22.0+ds-12.22.0+ds-1~exp12.23.0+ds-1
Show 9 moreShow less
2.23.0+ds-1~exp12.23.0+ds-1~exp22.23.1+ds-12.23.1+ds-23.1.5-1~exp13.2.3-1~exp13.3.5-13.3.5-1~exp13.4.1-1
 None known
c-blosc2
Ubuntu:24.04:LTS
 All versions, plus listed versions
2.12.0+ds-12.12.0+ds-22.13.1+ds-12.13.1+ds-1ubuntu12.13.1+ds-1.1ubuntu12.13.1+ds-1.1ubuntu2
 None known
c-blosc2
Ubuntu:26.10
 All versions, plus listed versions
2.23.0+ds-12.23.1+ds-12.23.1+ds-2
 None known
c-blosc2
Ubuntu:26.04:LTS
 All versions, plus listed versions
2.17.1+ds-22.22.0+ds-12.23.0+ds-1
 None known

History

History
RecordedChangedSources
affected, aliases, referencesOSV
affected, aliases, referencesOSV
affected, aliases, referencesOSV
referencesEUVD, NVD, OSV
referencesGitHub Advisories, OSV
referencesCVE List, EUVD, NVD
aliases, referencesGitHub Advisories
first indexedCVE List, EUVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-122330 is a medium vulnerability (CVSS 6.8) in Blosc C-blosc2, published November 5, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.24%, the 14th percentile. No source names a fixed version.

References

Show 8 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open