Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1336 CNY

100%
Buy Us a Coffee

CVE-2026-72854— msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation

Quick assessment

Affected
msgpack msgpack-c
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

src/unpack.c 中的 函数，通过公共 API 被调用。该函数使用未检查溢出的 加法来计算新缓冲区的大小，即把请求的大小与已使用的量相加。虽然其“翻倍”循环对自身乘法操作的溢出进行了防护，但循环条件中的加法缺乏防护。当请求的大小接近 时，加法会发生回绕（wrap around），导致循环条件在计算前就已满足；此时实际分配的缓冲区大小仅为回绕前的较小值，但函数仍返回真（true）。 因此，调用者被错误地告知已为其请求的容量预留了空间，而实际上并未预留。随后，若以请求的长度向该缓冲区写入数据，将导致堆缓冲区溢出

CVSS 5.3 · Medium EPSS 0.11% · P2

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

VendorProduct Version RangeStatus
msgpack msgpack-c ≤ 7.0.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-72854

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation
Source: CVE Program / CVE List V5
Vulnerability Description
msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the addition in the loop condition is unguarded, so a request near SIZE_MAX wraps: the loop condition is already satisfied, the allocation is performed at the small pre-wrap size, and the function returns true. The caller is told the requested capacity was reserved when it was not, so a subsequent write of the requested length overflows the heap buffer. The library's own example/lib_buffer_unpack.c demonstrates the reserve-then-write pattern, and its defensive assert comparing capacity against the request is compiled out under NDEBUG. msgpack-c's own decode entry points do not derive the reservation size from untrusted input, so reaching this requires an integration that passes an attacker-influenced length to the reservation API, such as a length-prefixed streaming transport.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L
Source: CVE Program / CVE List V5
Vulnerability Type
整数溢出或超界折返
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
msgpack msgpack-c 0 ~ 7.0.1 -

II. Public POCs for CVE-2026-72854

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-72854

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-72854 (1)

Vendor Advisories for CVE-2026-72854 (2)

Vendor Pages for CVE-2026-72854 (1)

Other References for CVE-2026-72854 (1)

IV. Related Vulnerabilities

Same vendor: msgpack
Same weakness: CWE-190

V. Comments for CVE-2026-72854

No comments yet

Leave a comment