CVE-2024-3203 is a high severity (CVSS 7.3) heap based buffer overflow in c-blosc2 up to version 2.13.2, in the ndlz8_decompress function. The record says upgrading to 2.14.3 addresses it. Upgrade c-blosc2, and any package that bundles it, to 2.14.3 or later.
What's affected
c-blosc2 up to and including 2.13.2, per the record. The affected function is ndlz8_decompress in the NDLZ codec plugin source file ndlz8x8.c. The description says upgrading to version 2.14.3 fixes the issue, and the record links the v2.14.3 release on GitHub. We did not confirm the state of versions between 2.13.2 and 2.14.3, so move to 2.14.3 or later rather than stopping at the next release.
The record says the attack can be launched remotely and that an exploit has been disclosed publicly. In a decompression library, the realistic route is feeding the program a crafted compressed buffer, so any application that decompresses data from outside your trust boundary is the one to look at.
CVE-2024-3204 is a sibling issue in a different function of the same codec family and has the same fix.
The weakness class: CWE-122, heap based buffer overflow. The NVD record scores it 7.3 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. CISA Known Exploited Vulnerabilities status in the record: not listed.
Source note: the description calls the issue critical (VulDB wording), while the NVD score is 7.3, High.
How to check if you're exposed
Find out whether c-blosc2 is in your build. It is a C library, and it is also bundled by other packages, notably the Python blosc2 wrapper.
pkg-config --modversion blosc2
pip show blosc2
The first command works if the library was installed with pkg-config metadata. Language wrappers and containers may vendor their own copy, so also check the lock files and image contents. The free scan at https://gold.safeguard.sh/scan can build an inventory from a project manifest.
What to do now
- Inventory every place c-blosc2 appears, including vendored copies and container images.
- Upgrade to 2.14.3 or later and rebuild dependent software.
- Until upgraded, avoid decompressing untrusted data with the NDLZ codec.
- Patch CVE-2024-3204 in the same upgrade.
Why it matters
Heap based buffer overflow, CWE-122, means the code wrote past the end of a heap allocation while decompressing. Decompressors are a classic source of these bugs because the output size depends on attacker controlled input.
The real exposure depends on whether untrusted data ever reaches the codec. Reachability analysis helps here: it separates the applications that call the vulnerable function from those that merely link the library.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need to act if I only use the Python blosc2 package?
Check whether your installed blosc2 build bundles a c-blosc2 older than 2.14.3, and whether your code decompresses data from untrusted sources. If either answer is yes, update the package to a release built against a fixed c-blosc2.
Sources
- References in the NVD record, not individually reviewed: the c-blosc2 v2.14.3 release page on GitHub and VulDB entry 259050
- Safeguard Gold entry for CVE-2024-3203
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
