CVE-2025-29476: 
Linux Debian vulnerability analysis and mitigation

Buffer Overflow vulnerability discovered in compress_chunk_fuzzer with oss-fuzz on commit 16450518afddcb3139de627157208e49bfef6987 in c-blosc2 version 2.17.0 and earlier. The vulnerability was disclosed on April 4, 2025, and received a CVSS v3.1 base score of 5.5 (Medium) from CISA-ADP (NVD, Debian).

The vulnerability is classified as CWE-120 (Buffer Copy without Checking Size of Input - Classic Buffer Overflow). The issue occurs in the _sw32 function, which causes an overflow due to an unexpected read from an allocated buffer. The heap-buffer-overflow was detected at address 0x504000003030, specifically a 4-byte-write overflow occurring 0 bytes after a 34-byte allocated region (GitHub Issue).

The vulnerability allows for a heap buffer overflow condition that could potentially lead to arbitrary code execution or system crashes. The CVSS v3.1 vector string (AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L) indicates that the vulnerability requires low attack complexity and can affect confidentiality, integrity, and availability (NVD).

The vulnerability can be reproduced using the compress_chunk_fuzzer with specific test cases. A proof of concept exists demonstrating the heap buffer overflow in the function chain _sw32--serial_blosc--do_job--blosc_compress_context--blosc2_compress (GitHub Issue).

The vulnerability has been fixed in c-blosc2 version 2.17.1+ds-1 as confirmed by Debian's security tracker. Users are advised to upgrade to this version or later to mitigate the vulnerability (Debian).