Medium severity · published Sep 30, 2026
CVE-2026-103222
Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflow
5.6
CVSS
0.3%
EPSS
No
On KEV
Description
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Attack vector
Network
Complexity
High
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
Low
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CB
C-Blosc2 · Blosc
3.3.0; 3.3.1; 3.3.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-103222
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-103222
vdb-entry
https://vuldb.com/vuln/411905
signature
https://vuldb.com/vuln/411905/cti
third-party-advisory
https://vuldb.com/cve/CVE-2026-103222
third-party-advisory
https://vuldb.com/submit/954976
patch
https://github.com/Blosc/c-blosc2/commit/fe2964d114d97847f56570a0ab2be2c57ccbeedc
patch
https://github.com/Blosc/c-blosc2/releases/tag/v3.3.3
More from C-Blosc2
9.8
CVE-2024-3204
c-blosc2 ndlz4x4.c ndlz4_decompress heap-based overflow
9.8
CVE-2024-3203
c-blosc2 ndlz8x8.c ndlz8_decompress heap-based overflow
7.8
CVE-2020-29367
blosc2.c in Blosc C-Blosc2 through 2.0.0.beta.5 has a heap-based buffer overflow when there is a lack of space to write compressed data
7.5
CVE-2023-37188
C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompress at zfp/blosc2-zfp.c
7.5
CVE-2023-37187
C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_decompress