Buffer Overflow Vulnerability in c-blosc2 Package - CVE-2025-29476
Summary
DEBIAN-CVE-2025-29476: Buffer Overflow vulnerability in compress_chunk_fuzzer with oss-fuzz on commit 16450518afddcb3139de627157208e49bfef6987 in c-blosc2 v.2.17.0 and before. Affects c-blosc2 versions < 2.17.1+ds-1. Fixed in 2.17.1+ds-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
c-blosc2 is a high-performance compressor optimized for binary data, commonly used in data science and machine learning applications. It provides efficient compression and decompression capabilities, allowing for faster data processing. However, the package has been identified to have a critical buffer overflow vulnerability that can be exploited under certain conditions.
Vulnerability Detail
The vulnerability, identified as CVE-2025-29476, arises from a buffer overflow in the 'compress_chunk_fuzzer' function, which was introduced in c-blosc2 version 2.17.0 and earlier. This flaw can lead to potential crashes or arbitrary code execution, posing significant security risks to applications relying on this library. The issue was discovered during fuzz testing and is linked to commit 16450518afddcb3139de627157208e49bfef6987.
How To Fix
Minimum fixed version
2.17.1+ds-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade c-blosc2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the fixed version as soon as it is available.
Conclusion
In summary, CVE-2025-29476 is a critical buffer overflow vulnerability in the c-blosc2 package that can lead to severe security issues. Users are strongly encouraged to update to the latest patched version to mitigate risks.
See every vulnerability recorded for c-blosc2 →
FAQ
CVE-2025-29476 is a buffer overflow vulnerability found in the c-blosc2 package, which can lead to crashes or arbitrary code execution.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Versions of c-blosc2 prior to 2.17.1+ds-1 are affected by this vulnerability.
While there are no specific workarounds, it is advisable to monitor your systems closely and apply the update as soon as possible.
More information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2025-29476.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for c-blosc2.
