PatchTheCVECVE-2024-3204: A vulnerability has been found in c-blosc2 up to 2.13.2 and classified as critical
CVE-2024-3204 is a high-severity flaw (CVSS 7.3) affecting c-blosc2. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
A vulnerability has been found in c-blosc2 up to 2.13.2 and classified as critical. Affected by this vulnerability is the function ndlz4_decompress of the file /src/c-blosc2/plugins/codecs/ndlz/ndlz4x4.c. The manipulation leads to heap-based buffer overflow. The attack can be launched remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 2.14.3 is able to address this issue. It is recommended to upgrade the
Why this priority
- High severity
- Public exploit reference
- Remotely exploitable, no login, no user action
A fixed release or distro patch exists.
Risk facts
| CVSS score | 7.3 (High) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | None |
| User interaction | None |
| EPSS exploit chance | 1.3% (top 30%) |
| CISA exploited list | No |
| Weakness | CWE-122 |
| Published | 2024-04-02 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-3204?
c-blosc2: upgrade to newer than 2.13.2. Exact commands for each OS are on this page.
Is CVE-2024-3204 being exploited?
CVE-2024-3204 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-3204 affect?
CVE-2024-3204 affects c-blosc2. Severity is high (CVSS 7.3). A vulnerability has been found in c-blosc2 up to 2.13.2 and classified as critical. Affected by this vulnerability is the function ndlz4_decompress of the file /src/c-blosc2/plugins/codecs/ndlz/ndlz4x4.c. The manipulation leads to heap-base
How urgent is CVE-2024-3204?
Priority 53/100. High severity; Public exploit reference; Remotely exploitable, no login, no user action
Related CVEs
- CVE-2024-3203 HIGH 7.3 UPGRADE A vulnerability, which was classified as critical, was found in c-blosc2 up to 2.13.2
- CVE-2023-37188 HIGH 7.5 UPGRADE C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_rate_decompres
- CVE-2023-37187 HIGH 7.5 UPGRADE C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the zfp/blosc2-zfp.c zfp_acc_de
- CVE-2023-37186 HIGH 7.5 UPGRADE C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference in ndlz/ndlz8x8.c via a NULL pointe
- CVE-2023-37185 HIGH 7.5 UPGRADE C-blosc2 before 2.9.3 was discovered to contain a NULL pointer dereference via the function zfp_prec_decompres