CVE-2026-48514
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
In the MessagePack library for C# prior to versions 2.5.301 and 3.1.7, there is a vulnerability that allows reading an attacker-controlled byteLength from an extension payload. This can lead to allocating a large T[] array without proper validation, potentially causing memory allocation issues.
Risk Assessment
This vulnerability may lead to Denial of Service (DoS) attacks due to excessive memory consumption, threatening application stability and potentially affecting service availability.
Recommendation
It is recommended to update the MessagePack library to versions 2.5.301 or 3.1.7 to mitigate this vulnerability and secure the application against potential attacks.
Original NVD description (English source)
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, UnsafeBlitFormatterBase<T>.Deserialize reads an attacker-controlled byteLength from an extension payload and allocates an array based on that value before validating it against the extension header length or remaining payload bytes. The outer extension header is bounded by available input, but that bound is not used to constrain the inner byteLength before allocation. A very small payload can therefore request a very large T[] allocation. This vulnerability is fixed in 2.5.301 and 3.1.7.