Heap-buffer Overflow Vulnerability in c-blosc2 Package
Summary
OSV-2025-312: Heap-buffer-overflow in ZSTD_decompressMultiFrame. Affects c-blosc2 versions >= e6035df1d3f285af9a2e756fb428633eb7898881. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
c-blosc2 is an open-source data compression library designed for high-performance data storage and retrieval. It is widely used in various applications for efficiently compressing and decompressing data. The library supports multiple compression algorithms and is optimized for speed, making it a popular choice among developers. However, like many software packages, it is susceptible to vulnerabilities that can compromise its functionality and security.
Vulnerability Detail
The vulnerability identified in c-blosc2 is a heap-buffer overflow that occurs during the decompression process, specifically in the ZSTD_decompressMultiFrame function. This issue can lead to potential crashes or arbitrary code execution, posing significant risks to applications that rely on this library. The vulnerability was reported through OSS-Fuzz, highlighting its critical nature and the need for immediate attention.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the affected decompression functions until a patch is applied. This may involve modifying your code to use alternative methods for data decompression or implementing additional checks to validate input data before processing.
Conclusion
The heap-buffer overflow vulnerability in the c-blosc2 package poses significant risks to applications utilizing this library. It is essential to update to the latest patched version to mitigate these risks. Additionally, using tools like Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring the security of your software.
See every vulnerability recorded for c-blosc2 →
FAQ
A heap-buffer overflow is a type of vulnerability that occurs when a program writes more data to a buffer located on the heap than it can hold, potentially leading to data corruption or execution of arbitrary code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply uploading your manifest file like package-lock.json, you can check if your application is affected by this vulnerability.
The consequences can range from application crashes to severe security breaches, including unauthorized access to sensitive data or system control.
Yes, it is crucial to update to the latest version of c-blosc2 that includes the patch for this vulnerability. Always refer to the official repository for the most recent updates.
Yes, you can use the Vulert playground to check for vulnerabilities in your application without requiring any signup. Simply visit Vulert Scanner and upload your manifest file.
References
Related vulnerabilities
Recent vulnerabilities recorded for c-blosc2.
