CVE-2026-122330Medium· 5.5▾ TwilightPoC availableBlosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize …
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 30.3 · likelihood 0 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.2%
Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.
c-blosc2 < 3.5.0Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103222Medium· 5.6A vulnerability was determined in Blosc C-Blosc2 up to 3.3.2
CVE-2026-121410Medium· 4.3FreeRDP before 3.32.2 Denial of Service via RDPGFX ALPHA WIRETOSURFACE_2
CVE-2026-59959Medium· 4.8SAIL: WebP decoder division by zero through malformed animated canvas metadata
CVE-2026-112054Medium· 5.5Schroedinger libschroedinger through 1.0.11 Divide by Zero in Low-Delay Transform Parsing
CVE-2026-112013Medium· 5.5libtta through 2.3 Divide by Zero via tta_decoder_init_get_info
CVE-2026-110605Medium· 5.5libschrift through 0.10.2 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a font with unitsPerEm of 0 in the head table