CVE-2026-103222 in C-Blosc2
Summary
by MITRE • 09/30/2026
A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 09/30/2026
The Blosc library, specifically the blosclz decompression module within versions up to 3.3.2, contains a critical implementation flaw in the blosclz_decompress function located in the source file blosc/blosclz.c. This vulnerability stems from an integer overflow condition that occurs during the processing of compressed data streams. The root cause lies in the arithmetic operations used to calculate buffer sizes or offsets based on input parameters derived from the compressed payload. When specific malformed inputs are processed, these calculations exceed the maximum value representable by the signed integer type utilized for memory allocation or indexing. This discrepancy allows an attacker to manipulate internal state variables, potentially leading to out-of-bounds reads or writes depending on how the overflowed values interact with subsequent memory management routines.
From a technical perspective, this flaw is categorized under CWE-190, which defines Integer Overflow or Wraparound vulnerabilities. The presence of such a defect in a widely used compression library poses significant risks because Blosc is often employed as a backend for high-performance data processing frameworks and scientific computing applications. An attacker who can supply crafted compressed data to the affected function can trigger this overflow. While the complexity of exploiting this vulnerability is considered high, it remains exploitable remotely if the application using Blosc accepts untrusted input from network sources without adequate validation or sanitization prior to decompression. The difficulty in exploitation suggests that precise control over memory layout and timing may be required to achieve meaningful code execution or denial of service outcomes, but the risk cannot be dismissed due to the fundamental nature of integer arithmetic errors in C-based libraries.
The operational impact of this vulnerability is primarily centered on system stability and data integrity. Successful exploitation could result in a crash of the application hosting the Blosc library, leading to a Denial of Service condition for services relying on real-time or batch decompression capabilities. In more severe scenarios where memory corruption leads to arbitrary code execution, an attacker might gain unauthorized access to sensitive information or take control of the underlying system. This aligns with ATT&CK techniques related to Initial Access via Exploitation of Remote Services and Defense Evasion through Obfuscated Files or Information if the compressed payload is used as a delivery mechanism for further malware stages. The remote nature of the attack vector means that any service exposing decompression functionality, such as file upload services, data ingestion pipelines, or API endpoints processing serialized objects, are potential targets.
To mitigate this risk, organizations must immediately upgrade the Blosc library to version 3.3.3 or later, where the integer overflow has been addressed by the patch identified as fe2964d114d97847f56570a0ab2be2c57ccbeedc. This update likely includes bounds checking and validation logic to ensure that calculated sizes do not exceed allocated memory limits or trigger wraparound conditions. In addition to upgrading, developers should implement strict input validation for any data passed to decompression functions, ensuring that headers and size fields conform to expected ranges before processing begins. Furthermore, employing compiler-based security features such as stack protectors and address space layout randomization can help mitigate the impact of memory corruption vulnerabilities if they are triggered in production environments until patches are fully deployed across all affected systems.