Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-72854— msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation

Quick assessment

Affected
msgpack msgpack-c
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

MessagePack msgpack for C/C++是MessagePack组织的一款高效的二进制序列化库。 MessagePack msgpack for C/C++ 7.0.1及之前版本存在安全漏洞，该漏洞源于MessagePack_unpacker_expand_buffer函数在计算缓冲区大小时未检查size_t加法，可能导致整数溢出，进而造成堆缓冲区溢出。

CVSS 5.3 · Medium EPSS 0.16% · P4

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
msgpack msgpack-c ≤ 7.0.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-72854

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation
Source: CVE Program / CVE List V5
Vulnerability Description
msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the addition in the loop condition is unguarded, so a request near SIZE_MAX wraps: the loop condition is already satisfied, the allocation is performed at the small pre-wrap size, and the function returns true. The caller is told the requested capacity was reserved when it was not, so a subsequent write of the requested length overflows the heap buffer. The library's own example/lib_buffer_unpack.c demonstrates the reserve-then-write pattern, and its defensive assert comparing capacity against the request is compiled out under NDEBUG. msgpack-c's own decode entry points do not derive the reservation size from untrusted input, so reaching this requires an integration that passes an attacker-influenced length to the reservation API, such as a length-prefixed streaming transport.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5
Vulnerability Title
MessagePack msgpack for C/C++ 数字错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
MessagePack msgpack for C/C++是MessagePack组织的一款高效的二进制序列化库。 MessagePack msgpack for C/C++ 7.0.1及之前版本存在安全漏洞，该漏洞源于MessagePack_unpacker_expand_buffer函数在计算缓冲区大小时未检查size_t加法，可能导致整数溢出，进而造成堆缓冲区溢出。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
msgpack msgpack-c 0 ~ 7.0.1 -

II. Public POCs for CVE-2026-72854

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-72854

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-72854 (1)

Vendor Advisories for CVE-2026-72854 (2)

Vendor Pages for CVE-2026-72854 (1)

Other References for CVE-2026-72854 (1)

IV. Related Vulnerabilities

Same vendor: msgpack
Same weakness: CWE-190

V. Comments for CVE-2026-72854

No comments yet

Leave a comment