CVE-2024-3204 is a high severity (CVSS 7.3) heap based buffer overflow in c-blosc2 up to version 2.13.2, in the ndlz4_decompress function. The record says upgrading to 2.14.3 addresses it. Upgrade c-blosc2 and any package that bundles it to 2.14.3 or later.
What's affected
c-blosc2 up to and including 2.13.2. The affected function is ndlz4_decompress in ndlz4x4.c, part of the NDLZ codec plugin. The description says upgrading to version 2.14.3 fixes it, and the record links that GitHub release. We did not confirm versions between 2.13.2 and 2.14.3, so go to 2.14.3 or later.
The record says the attack can be launched remotely and an exploit is public. This is the 4x4 variant of the same decompression issue described in CVE-2024-3203, which covers the 8x8 variant. One upgrade covers both.
The weakness class: CWE-122, heap based buffer overflow. The NVD record scores it 7.3 (high) with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. CISA Known Exploited Vulnerabilities status in the record: not listed.
Source note: the description calls the issue critical (VulDB wording), while the NVD score is 7.3, High.
How to check if you're exposed
List c-blosc2 and anything bundling it.
pkg-config --modversion blosc2
pip show blosc2
Vendored copies and container images will not show up in those commands, so check lock files and image layers as well. A dependency scan of the repository or image gives a faster, complete list.
What to do now
- Find every c-blosc2 copy in your builds and images.
- Upgrade to 2.14.3 or later and rebuild.
- Do not decompress NDLZ data from untrusted sources until you have upgraded.
- Patch CVE-2024-3203 at the same time.
Why it matters
The class is CWE-122, a heap based buffer overflow. Two near identical bugs in sibling codec variants point to a pattern: a size or offset from the compressed stream is trusted too far in the decode loop.
For defenders the useful question is data flow. If the only data you decompress is data you wrote yourself, exposure is low. If a service accepts compressed arrays from users, it is not.
Quick check
Is this the same bug as CVE-2024-3203?
No. It is a separate overflow in a different function, ndlz4_decompress instead of ndlz8_decompress. Both are fixed by upgrading to 2.14.3 according to the record.
Sources
- References in the NVD record, not individually reviewed: the c-blosc2 v2.14.3 release page on GitHub and VulDB entry 259051
- Safeguard Gold entry for CVE-2024-3204
- Free in-browser dependency scan
Last reviewed: 19 October 2026.
