Stack Overflow Vulnerability in MessagePack for C# by MessagePack

CVE-2026-48502

What is CVE-2026-48502?

A vulnerability exists in the MessagePack for C# serializer, where the MessagePackReader.ReadDateTime() method can allocate excessive stack memory based on an attacker-controlled MessagePack extension length. This occurs specifically during the slow path for timestamp extension parsing. The vulnerability allows an attacker to craft a payload that requests a large timestamp extension body, which can lead to a stack allocation error, ultimately resulting in a StackOverflowException that crashes the host process. This issue has been remediated in versions 2.5.301 and 3.1.7.

References