Integer Overflow Vulnerability in msgpack-c Library by MsgPack

CVE-2026-72854

What is CVE-2026-72854?

An integer overflow vulnerability exists in the msgpack-c library's msgpack_unpacker_expand_buffer function, as it improperly computes the required buffer size without verifying its inputs. This flaw can lead to a false success during buffer reservation, allowing an attacker to cause a heap buffer overflow when writing data. The vulnerability arises particularly in situations where user-influenced lengths are passed to the reservation API, which may be exploited in integrated systems that utilize this library.

References