---
id: "CVE-2026-122330"
kind: "vulnerability"
aliases: ["CVE-2026-122330"]
title: "Blosc c-blosc2: crafted frame crashes applications via divide-by-zero"
severity: "medium"
cvss: 6.8
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["blosc2", "c-blosc2", "package", "python"]
not_affected_if: ["trusted-input-only", "version-3.5.0-or-later"]
published_at: "2026-11-05T16:17:46+00:00"
first_seen_at: "2026-11-05T16:40:02+00:00"
updated_at: "2026-11-05T16:41:40+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-122330", "first_seen_at": "2026-11-05T16:40:02+00:00"}]
exploit_sources: []
---

# Blosc c-blosc2: crafted frame crashes applications via divide-by-zero

Blosc c-blosc2 before 3.5.0 divides by zero when reading a slice of a crafted Blosc2 frame that has a zero chunksize or blocksize. An attacker who supplies such a frame crashes the process that reads it (SIGFPE).

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed c-blosc2 version, for example `blosc2_version` or the package manager listing, and see whether it is below `3.5.0`.
- Look for code that calls `blosc2_schunk_open()` or `blosc2_schunk_from_buffer()` on data from outside your control.

## Fix

- c-blosc2 `3.5.0` (fixed version per the NVD description; the patch is linked from the sources)

## Timeline

- 2026-11-05T16:40:02+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-122330

## Documents

- [advisory] Third-party advisory: www.vulncheck.com https://www.vulncheck.com/advisories/blosc-c-blosc2-before-3.5.0-divide-by-zero-via-blosc2-schunk-get-slice-buffer
- [fix] Patch: github.com https://github.com/Blosc/c-blosc2/commit/4fff1787408d94b895c6f9cb50f7925ad5919052

## From the sources

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_