C blosc2: Heap-buffer-overflow
Affects c-blosc2Source GCVE Database
Rated by Threat Radar
Data as of 17 Sep 2026, 20:35 UTC
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
OSS-Fuzzc-blosc2pkg:generic/c-blosc2Other threats | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
Until a patch is available, users should monitor updates from the c-blosc2 maintainers and consider applying any official fixes once released.
Description
A heap-buffer-overflow vulnerability exists in the c-blosc2 library within the ZSTD_decompressSequencesLong_bmi2 function. This issue was identified by OSS-Fuzz and involves an out-of-bounds read of 8 bytes during decompression sequences. The vulnerability affects multiple versions of c-blosc2 up to and including version 3.2.0 and some later commits. No CVSS score is provided, but the severity is assessed as medium.