CVE-2026-122330

Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2 schunk get slice buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2 schunk open() or blosc2 schunk from buffer() and read as a slice, raising SIGFPE and terminating the process.