TI-2026-85475 Aliases CVE-2026-122330 GHSA-99fx-294r-j6xw

Divide-by-zero in Blosc c-blosc2 lets crafted frames crash applications

MEDIUM 63CWE-369Published 2026-11-05 · Updated 2026-11-05

Key facts

Attack vector: Local
Privileges required: None
User interaction: Passive
Attack complexity: Low
Attack requirements: None
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-369.

Summary

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero flaw (CWE-369) in blosc2_schunk_get_slice_buffer() that a crafted Blosc2 frame can trigger. A zero chunksize or blocksize value is not checked before division. An attacker who supplies a malicious frame opened with blosc2_schunk_open() or blosc2_schunk_from_buffer() can crash an application that reads it as a slice, because the process terminates on SIGFPE. The attack requires a local user to open or process the crafted frame.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00237 14th percentileScored 2026-11-07

Fix Fixed c-blosc2 (Blosc): 3.5.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Blosc	c-blosc2	before 3.5.0	3.5.0	Patch available	CNA

c-blosc2 VendorBlosc Affected before 3.5.0 Fixed in 3.5.0 Patch available CNA

Remediation

Update Blosc c-blosc2 to version 3.5.0, which fixes the flaw. The sources list no other fixed version for c-blosc2.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Fix · CNA c-blosc2 (Blosc) Fixed in 3.5.0

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product

Red Hat

Timeline

2026-11-05 Threatist record created from CVE-2026-122330
2026-11-05 Alias added: GHSA-99fx-294r-j6xw
2026-11-05 CISA SSVC decision points changed
2026-11-06 Affected versions changed · Red Hat
2026-11-06 CVSS score added · Red Hat

References

Patch 1

https://github.com/Blosc/c-blosc2/commit/4fff1787408d94b895c6f9cb50f7925ad5919052

Advisory 1

https://hackmd.io/@haindpwn/c-blosc2-schunk-slice-divide-by-zero

Other 4

TI-2024-03004 c-blosc2 ndlz4x4.c ndlz4_decompress heap-based overflow CVSS 3.1CRITICAL 9.8
TI-2024-03003 c-blosc2 ndlz8x8.c ndlz8_decompress heap-based overflow CVSS 3.1CRITICAL 9.8
TI-2023-18819 C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the… CVSS 3.1HIGH 7.5
TI-2020-17648 blosc2.c in Blosc C-Blosc2 through 2.0.0.beta.5 has a heap-based buffer overflow when… CVSS 3.1HIGH 7.8
TI-2023-18822 C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the… CVSS 3.1HIGH 7.5
TI-2023-18821 C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the… CVSS 3.1HIGH 7.5

See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences