Description
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Blosc | C-Blosc2 | 3.3.0, 3.3.1, 3.3.2 | 3.3.3 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | c-blosc2 | 3.3.5-1 | — |
| Debian 13 | c-blosc2 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | c-blosc2 | No fix yet | — |
| Ubuntu 26.04 LTS | c-blosc2 | No fix yet | — |
| Ubuntu 24.04 LTS | c-blosc2 | No fix yet | — |
References
- VDB-411905 | Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflow vdb-entry technical-description
- VDB-411905 | CTI Indicators (IOB, IOC, IOA) signature permissions-required
- CVE-2026-103222 | CVE Analysis and Report third-party-advisory
- Submit #954976 | Blosc c-blosc2 >= 2.0.0, < fix commit fe2964d114d9 Memory Corruption third-party-advisory
- https://github.com/Blosc/c-blosc2/commit/fe2964d114d97847f56570a0ab2be2c57ccbeedc patch
- https://github.com/Blosc/c-blosc2/releases/tag/v3.3.3 patch
- https://github.com/Blosc/c-blosc2/ product