CVE-2026-122330

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-122330
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-122330.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-122330
Published
2026-11-05T15:11:48Z
Modified
2026-11-05T21:32:22Z
Severity
  • 6.8 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Blosc c-blosc2 before 3.5.0 Divide-by-Zero via blosc2_schunk_get_slice_buffer()
Details

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.

Database specific 
{
    "cna_assigner": "VulnCheck",
    "cwe_ids": [
        "CWE-369"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/122xxx/CVE-2026-122330.json"
}
References

Affected packages

Git / github.com/blosc/c-blosc2

Affected ranges

Type
GIT
Repo
https://github.com/blosc/c-blosc2
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
4d35a0dbeee037c0c724a96a8e5ed9b07c31b67f
Fixed
4fff1787408d94b895c6f9cb50f7925ad5919052
Database specific
Show details 
{
    "extracted_events": [
        {
            "range": [
                {
                    "introduced": "0"
                },
                {
                    "fixed": "3.5.0"
                }
            ],
            "source": "AFFECTED_FIELD",
            "strategy": "StandardRange"
        },
        {
            "range": [
                {
                    "fixed": "4fff1787408d94b895c6f9cb50f7925ad5919052"
                }
            ],
            "source": "REFERENCES_COMMIT"
        }
    ]
}

Affected versions

v2.*
v2.0.0
v2.0.0-beta.1
v2.0.0-beta.3
v2.0.0-beta.4
v2.0.0-rc2
v2.0.0.beta.5
v2.0.0.rc1
v2.0.0a2
v2.0.0a3
v2.0.0a4
v2.0.0a5
v2.0.1
v2.0.2
v2.0.3
v2.0.4
v2.1.0
v2.1.1
v2.10.0
v2.10.1
v2.10.2
v2.10.3
v2.10.4
v2.11.0
v2.11.1
v2.11.2
v2.11.3
v2.12.0
v2.13.0
v2.13.1
v2.13.2
v2.14.0
v2.14.1
v2.14.2
v2.14.3
v2.14.4
v2.15.0
v2.15.1
v2.15.2
v2.16.0
v2.17.0
v2.17.1
v2.18.0
v2.19.0
v2.19.1
v2.2.0
v2.20.0
v2.21.0
v2.21.1
v2.21.2
v2.21.3
v2.22.0
v2.23.0
v2.23.1
v2.3.0
v2.3.1
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.5.0
v2.6.0
v2.6.1
v2.7.0
v2.7.1
v2.8.0
v2.9.0
v2.9.1
v2.9.2
v2.9.3
v3.*
v3.0.0
v3.0.0.rc1
v3.0.0.rc2
v3.0.1
v3.0.2
v3.0.3
v3.1.0
v3.1.1
v3.1.2
v3.1.3
v3.1.4
v3.1.5
v3.2.0
v3.2.1
v3.2.2
v3.2.3
v3.3.0
v3.3.1
v3.3.2
v3.3.3
v3.3.4
v3.3.5
v3.4.0
v3.4.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-122330.json"