ANT-2026-ZGY30A9P · c-blosc2

heap-buffer-overflow medium

Severity Claude medium · Security research firm medium · Maintainer -

Discovered by Claude Mythos Preview

REPORT

Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits.

ANT-2026-ZGY30A9P: Heap buffer overflow in compression header block-starts write due to undersized buffer

Heap buffer overflow when writing block-starts in the compression header due to an undersized buffer allocation.

Target

Project: c-blosc2
Discovery: static analysis — not yet dynamically reproduced

Technical Details

The buffer allocated for the compression header's block-starts is undersized, causing a heap write past the end of the allocation.

Reproduction

This finding was identified by static analysis and has not yet been dynamically reproduced. The Technical Details section above describes the code path; a trigger input is not included.

[No reproducer or sanitizer output attached — request from security-cvd@anthropic.com if needed.]

Acknowledgement

This vulnerability was discovered by Claude, Anthropic's AI assistant, and triaged by the Anthropic security team in collaboration with Anthropic Research. Please direct questions to security-cvd@anthropic.com and reference ANT-2026-ZGY30A9P.

Reference: ANT-2026-ZGY30A9P
Anthropic CVD Policy: https://www.anthropic.com/coordinated-vulnerability-disclosure

SECURITY RESEARCH FIRM ANALYSIS

Triage and disclosure were performed by Trail of Bits.

Verdict
true positive
Severity
medium
TIMELINE

Dates from discovery through public reveal.

  1. 2026-03-27 Sent to maintainer
  2. 2026-03-27 Patch released
  3. 2026-03-29 Reported to tracker
  4. 2026-05-09 Maintainer acknowledged
  5. 2026-08-17 Publicly revealed
PROVENANCE

SHA-3-512 hash:

0f5a03eb1d1a958f92007e3958e19f99d31d84726960429dbf184d7182964697fbec015d71751121c44d57706247aa4a8fe212f82f9986a6ba4e372af5c6e73a

Committed 2026-04-09 11:49 PT

Revealed 2026-08-17 13:02 PT

Verify (download preimage.json)

Show preimage JSON 
{
  "ant_id": "ANT-2026-ZGY30A9P",
  "bug_class": "Heap Buffer Overflow",
  "claude_severity": "medium",
  "commit_sha": null,
  "created_at": "2026-03-29T20:42:41+00:00",
  "description": "Heap buffer overflow when writing block-starts in the compression header due to an undersized buffer allocation.",
  "discovered_at": null,
  "location": null,
  "poc_sha256": null,
  "preimage_version": 1,
  "project": "c-blosc2",
  "reproduction": null,
  "technical_details": "The buffer allocated for the compression header's block-starts is undersized, causing a heap write past the end of the allocation.",
  "title": "Heap buffer overflow in compression header block-starts write due to undersized buffer",
  "vendor_severity": "medium"
}