Uncontrolled Stack Allocation Vulnerability in Nerdbank.MessagePack Library

CVE-2026-44375

What is CVE-2026-44375?

The Nerdbank.MessagePack library, which is used for MessagePack serialization, contains an uncontrolled stack allocation vulnerability prior to version 1.1.62. This flaw arises in the DateTime decoding process, where a maliciously crafted MessagePack payload can specify an oversized timestamp extension length. This results in the reader allocating an unbounded number of bytes on the stack, potentially causing a StackOverflowException. This exception cannot be caught by user code, leading to an abrupt termination of the process and unexpected application behavior. To mitigate this issue, users are advised to upgrade to version 1.1.62 or later.

References