CVE-2026-103222CWE-190

CVE-2026-103222

Medium · published September 30, 2026

CVSS v3.1
5.6
EPSS
0%
Percentile
19.2
In the wild
Unconfirmed
What it is

A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2. This impacts the function blosclz_decompress of the file blosc/blosclz.c of the component blosclz Decompression. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. A high complexity level is associated with this attack. The exploitability is said to be difficult. Upgrading to version 3.3.3 will fix this issue. This patch is called fe2964d114d97847f56570a0ab2be2c57ccbeedc. The affected component should be upgraded.

The record
Technical detail
CVSS v3.1
5.6 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
6.3 · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:X
EPSS
0.00278 · 19.2th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-09-30T19:22Z
References (7)
https://github.com/Blosc/c-blosc2/ · [email protected]https://github.com/Blosc/c-blosc2/commit/fe2964d114d97847f56570a0ab2be2c57ccbeedc · [email protected]https://github.com/Blosc/c-blosc2/releases/tag/v3.3.3 · [email protected]https://vuldb.com/cve/CVE-2026-103222 · [email protected]https://vuldb.com/submit/954976 · [email protected]https://vuldb.com/vuln/411905 · [email protected]https://vuldb.com/vuln/411905/cti · [email protected]
EPSS history
Timeline
  • 02 OCT 03:41Z
    EPSS moved — → 0%
    epss
  • 30 SEP 14:00Z
    Blosc C-Blosc2 blosclz Decompression blosclz.c blosclz_decompress integer overflow
    cvelistv5