PatchTheCVECVE-2024-3203: A vulnerability, which was classified as critical, was found in c-blosc2 up to 2.13.2
CVE-2024-3203 is a high-severity flaw (CVSS 7.3) affecting c-blosc2. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability, which was classified as critical, was found in c-blosc2 up to 2.13.2. Affected is the function ndlz8_decompress of the file /src/c-blosc2/plugins/codecs/ndlz/ndlz8x8.c. The manipulation leads to heap-based buffer overflow. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.14.3 is able to address this issue. It is recommended to upgrade the affected c
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.3 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.4% (top 28%) |
| CISA exploited list | No |
| Weakness | CWE-122 |
| Published | 2024-04-02 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-3203?
c-blosc2: upgrade to newer than 2.13.2. Exact commands for each OS are on this page.
Is CVE-2024-3203 being exploited?
CVE-2024-3203 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-3203 affect?
CVE-2024-3203 affects c-blosc2. Severity is high (CVSS 7.3). A vulnerability, which was classified as critical, was found in c-blosc2 up to 2.13.2. Affected is the function ndlz8_decompress of the file /src/c-blosc2/plugins/codecs/ndlz/ndlz8x8.c. The manipulation leads to heap-based buffer overflow.
How urgent is CVE-2024-3203?
Priority 53/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2024-3204 HIGH 7.3 UPGRADE A vulnerability has been found in c-blosc2 up to 2.13.2 and classified as critical
- CVE-2023-37188 HIGH 7.5 UPGRADE C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompres
- CVE-2023-37187 HIGH 7.5 UPGRADE C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_de
- CVE-2023-37186 HIGH 7.5 UPGRADE C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference in ndlz/ndlz8x8.c via a NULL pointe
- CVE-2023-37185 HIGH 7.5 UPGRADE C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_prec_decompres