C-Blosc2 CVE-2026-103222

Exploitation requires that a target application built against C-Blosc2 3.3.2 or earlier actually invoke blosclz_decompress on attacker-influenced compressed input using the blosclz codec - i.e., the application must accept and decompress untrusted Blosc2/blosclz data. The attacker must craft length and offset fields that overflow the additive output-buffer bounds check. Limiting factors: the vendor rates the attack as high-complexity and 'difficult' (AC:H), impacts are Low across confidentiality/integrity/availability, and there is no user-interaction or privilege requirement per the vector, but successful triggering depends on the specific codec path and the application feeding untrusted data through it; no default network service is exposed by the library itself.

This is a real but low-priority memory-safety defect in the blosclz codec of C-Blosc2. The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:N with VC/VI/VA all Low, base 6.3) signals a remotely reachable but hard-to-exploit integer overflow: the vendor description explicitly says the flaw is of 'high complexity' and that 'exploitability is said to be difficult,' consistent with AC:H. No EPSS score, no CISA KEV listing, and no public proof-of-concept exploit accompany this record - so there is no public exploit identified at time of analysis and no evidence of active exploitation. The source diff corroborates the CWE-190 classification: the fix replaces additive bounds checks like (op) + len > op_limit (which can wrap when op + len overflows the pointer/size arithmetic) with subtraction-based checks len > op_limit - op, and adds an explicit len > maxout guard in blosclz_decompress. The included regression tests (oversized match, oversized literal, crafted Blosc2 chunk) demonstrate that unchecked lengths could previously drive writes past the output buffer, so the realistic worst case is out-of-bounds write / memory corruption rather than a benign miscount - the vendor nonetheless kept impacts at Low, and the high attack complexity keeps real-world risk modest. Net: patch on a normal cadence; this is not an emergency.

An application links C-Blosc2 (≤3.3.2) and decompresses blosclz-compressed data received from an untrusted source (a file, network stream, or dataset). An attacker crafts a malformed compressed block with length/offset fields engineered to overflow the internal bounds arithmetic, causing blosclz_decompress to write past the output buffer. No public PoC exists, and the vendor rates exploitation as difficult, so achieving reliable code execution (versus a crash) would require significant effort.