CVE-2026-122330
Description
A flaw was found in c-blosc2. This vulnerability allows an attacker to cause a Denial of Service (DoS) by providing a specially crafted compressed data frame containing zero chunk or block size values. When an application attempts to read a data slice from the malicious frame, an unhandled division-by-zero error triggers an abnormal process crash.
Statement
This vulnerability is rated as Moderate severity because successful exploitation requires user interaction to load untrusted data and is constrained to an application crash, posing no threat to data confidentiality or integrity. Applications utilizing the c-blosc2 library are susceptible to termination via an arithmetic exception when attempting to parse specifically malformed compressed data slices. Because the defect does not permit remote code execution or privilege escalation, the overall operational risk remains contained to local availability.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Understanding the Weakness (CWE)
Availability
Technical Impact: DoS: Crash, Exit, or Restart
A Divide by Zero results in a crash.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
