Buffer Overflow Vulnerability in c-blosc2 Package
Summary
CVE-2025-29476: Buffer Overflow vulnerability in compress_chunk_fuzzer with oss-fuzz on commit 16450518afddcb3139de627157208e49bfef6987 in c-blosc2 v.2.17.0 and before. Affects c-blosc2 versions < 2.17.1+ds-1. Fixed in 2.17.1+ds-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
c-blosc2 is a high-performance compressor optimized for binary data, widely used in data-intensive applications. It provides efficient data compression and decompression, making it essential for applications that require fast data processing. However, versions 2.17.0 and earlier are susceptible to a buffer overflow vulnerability, which can lead to severe security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2025-29476, arises from a buffer overflow in the compress_chunk_fuzzer function within the c-blosc2 package. This issue was introduced in commit 16450518afddcb3139de627157208e49bfef6987. If exploited, it could allow an attacker to execute arbitrary code, potentially compromising the integrity and confidentiality of the affected system.
How To Fix
Minimum fixed version
2.17.1+ds-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade c-blosc2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, users can avoid using the compress_chunk_fuzzer function until the package is updated. This may limit some functionality but will help mitigate the risk of exploitation.
Conclusion
The buffer overflow vulnerability in the c-blosc2 package poses significant security risks. Users are strongly advised to update to the latest version to protect their systems. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for c-blosc2 →
FAQ
CVE-2025-29476 is a buffer overflow vulnerability in the c-blosc2 package that can lead to arbitrary code execution.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could allow attackers to execute arbitrary code, potentially leading to data breaches or system compromise.
Yes, a patch is available in versions of c-blosc2 released after 2.17.0. Users should update to a patched version to mitigate the risk.
Vulert is a tool that monitors and alerts users in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
Related vulnerabilities
Recent vulnerabilities recorded for c-blosc2.
