DEBIAN-CVE-2026-103222

See a problem?
Please try reporting it to the source first.

Source

https://security-tracker.debian.org/tracker/CVE-2026-103222

Import Source

https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-103222.json

JSON Data

https://api.osv.dev/v1/vulns/DEBIAN-CVE-2026-103222

Upstream

CVE-2026-103222

Published

2026-09-30T15:22:25Z

Modified

2026-10-01T05:00:35Z

Severity

6.3 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X CVSS Calculator

Summary

[none]

Details

A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.

References

https://security-tracker.debian.org/tracker/CVE-2026-103222

Affected packages

Debian:13 / c-blosc2

Package

Name: c-blosc2
Purl: pkg:deb/debian/c-blosc2?arch=source&distro=trixie

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Affected versions

2.*

2.17.1+ds-1

2.17.1+ds-2

2.22.0+ds-1~exp1

2.22.0+ds-1

2.23.0+ds-1~exp1

2.23.0+ds-1~exp2

2.23.0+ds-1

2.23.1+ds-1

2.23.1+ds-2

3.*

3.1.5-1~exp1

3.2.3-1~exp1

Ecosystem specific

{
    "urgency":  "not yet assigned"
}

Database specific

source

"https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-103222.json"

Debian:14 / c-blosc2