CVE-2026-122330
Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attack
CVSS
5.5
Medium
EPSS
—
KEV
—
Exploit Today
0
0-100
Published: Nov 5, 2026 · Last modified: Nov 5, 2026 · CWE-369
Not enough EPSS history yet.
Blosc c-blosc2 before 3.5.0 contains a divide-by-zero vulnerability in blosc2_schunk_get_slice_buffer() in blosc/schunk.c that allows attackers to crash applications by supplying crafted frames with unchecked zero chunksize or blocksize values. Attackers can provide a malicious Blosc2 frame opened via blosc2_schunk_open() or blosc2_schunk_from_buffer() and read as a slice, raising SIGFPE and terminating the process.
- github.comhttps://github.com/Blosc/c-blosc2
- github.comhttps://github.com/Blosc/c-blosc2/blob/v3.4.1/blosc/frame.c#L1214-L1227
- github.comhttps://github.com/Blosc/c-blosc2/blob/v3.4.1/blosc/schunk.c#L1662-L1700
- github.comhttps://github.com/Blosc/c-blosc2/commit/4fff1787408d94b895c6f9cb50f7925ad5919052
- github.comhttps://github.com/Blosc/c-blosc2/issues/834
- hackmd.iohttps://hackmd.io/@haindpwn/c-blosc2-schunk-slice-divide-by-zero
- www.vulncheck.comhttps://www.vulncheck.com/advisories/blosc-c-blosc2-before-3.5.0-divide-by-zero-via-blosc2-schunk-get-slice-buffer
- hackmd.iohttps://hackmd.io/@haindpwn/cve-2026-122330-c-blosc2-schunk-slice-divide-by-zero
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1073596.5 MED—
——0Improper input validation in the beacon handler for WF200 firmware versions 3.17.0 and earlier may result in a divide-by-zero fault.7hCVE-2026-1214104.3 MED14.4%
——4FreeRDP before 3.32.2 contains a denial of service vulnerability in the RDPGFX ALPHA WIRETOSURFACE_2 handler that fails to validate zero surface dimensions. A malicious RDP server can send a crafted WIRETOSURFACE_2 PDU with zero width and height, triggering an assertion or division by zero that terminates the client session.2dCVE-2026-651605.5 MED5.6%
——2NVIDIA nvJPEG contains a vulnerability where an attacker could cause a divide-by-zero. A successful exploit of this vulnerability might lead to denial of service.2dCVE-2026-59959—2.3%
——1SAIL is a cross-platform library for loading and saving images with support for animation, metadata, and ICC profiles. Prior to version 1.0.2, the built-in WebP decoder can crash during loader initialization when processing a malformed animated WebP file with inconsistent container or `ANMF` frame metadata. In `sail_codec_load_init_v8_webp()` in `src/sail-codecs/webp/webp.c`, `WebPDemuxGetI` with `WEBP_FF_CANVAS_WIDTH` can return a zero `image_local->width`, which is then used as a divisor when calculating `bytes_per_pixel` from the image row size. The division happens before frame decoding and before generic image skeleton validation in `src/sail/sail_advanced.c`, causing an arithmetic fault and process termination. Applications accepting untrusted WebP images can consequently suffer denial of service; builds must include the affected WebP codec. This issue is fixed in version 1.0.2.7dCVE-2026-1120545.5 MED7.9%
——2Schroedinger libschroedinger through 1.0.11 contains a divide by zero vulnerability that allows attackers to crash applications by supplying a zero slice_bytes_denom or slice count in a Dirac stream. Attackers can provide a crafted low-delay picture parsed by schro_decoder_parse_transform_parameters and schro_decoder_parse_lowdelay_transform_data to trigger a SIGFPE and cause denial of service.15dCVE-2026-1120135.5 MED2.7%
——1libtta through 2.3 contains a divide-by-zero vulnerability in tta_decoder_init_get_info() that allows attackers to crash applications by supplying an unvalidated zero sample rate. Attackers can craft a .tta file with a recomputed header CRC32 that triggers SIGFPE, crashing applications including the bundled tta console tool.17d