CVE-2026-122330

Name	CVE-2026-122330
Description	Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
c-blosc2 (PTS)	trixie	2.17.1+ds-1	vulnerable
	forky, sid	3.4.1-1	vulnerable

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
c-blosc2	source	(unstable)	(unfixed)

Notes

[trixie] - c-blosc2 <no-dsa> (Minor issue)
https://github.com/Blosc/c-blosc2/issues/834
https://github.com/Blosc/c-blosc2/commit/4fff1787408d94b895c6f9cb50f7925ad5919052 (v3.5.0)