MessagePack CVE-2024-48514: UnityBlit Formatter Unbounded Allocation Vulnerability

Unity unsafe blit formatter allocates from unbounded byte length Vulnerability Overview CVE ID: CVE-2024-48514 CVSS v4 base metrics: - Attack Vector: Network - Attack Complexity: High - Attack Requirements: Present - Privileges Required: None - User Interaction: None - Vulnerable System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: Low - Subsequent System Impact Metrics: - Confidentiality: None - Integrity: None - Availability: None Weaknesses: CWE-770 Credits: AAmett (Remediation developer) Affected Scope Package: MessagePack (NuGet) Affected versions: [0.0.2.5.300], [3.0.3.1.7] Patched versions: 2.5.301, 3.1.7 Description Summary: reads an attacker-controlled from the extension payload and allocates an array based on this value before validation. This value may not match the extension header length or the remaining payload bytes. While the external extension header is constrained by the available input, this constraint is not used to bound the allocation for the internal . A very small payload can request a very large allocation. Impact: Applications are affected when untrusted payloads are deserialized using the Unity blit resolver, such as or . This is particularly relevant for Unity multiplayer clients or servers using MessagePack-CSharp for network values such as vectors, matrices, or primitive arrays. A malicious peer can send an extension payload with a large declared byte length, leading to an out-of-memory exception or process termination on memory-constrained platforms. The resolver is optional, but the validation value acts as pure input, and the allocation occurs before the formatter verifies whether the declared bytes actually exist in the extension body. Affected Components Package: MessagePack.UnityClient Resolvers: UnityBlitResolver, UnityBlitWithPrimitiveArrayResolver API: UnsafeBlitFormatterBase.Deserialize Finding IDs: MESSAGEPACKCSHARP-000, duplicate/open variant MESSAGEPACKCSHARP-OPEN-019 Remediation Patches: The fix is ready and will be released in a coordinated patch version. Upgrade guidance: 1. Upgrade to the patched version for your release line. 2. Upgrade the companion MessagePack package in the same dependency graph to the coordinated patch version. Fix details: The fix should validate before allocation, rejecting negative lengths, lengths greater than the extension body length, and lengths that are not valid multiples of the element size. Workarounds Workarounds: Patching is recommended. Until patched versions are available, do not use the Unity blit resolver for data from untrusted peers. Use a safer resolver or explicitly validate and size-limit messages before deserialization. References MESSAGEPACKCSHARP-000: unsafe blit formatter allocation from unbounded byte length MESSAGEPACKCSHARP-OPEN-018: duplicate/open finding for the same root cause CWE-770: Allocation of Resources Without Limits or Throttling

Goal Reached Thanks to every supporter — we hit 100%!

MessagePack CVE-2024-48514: UnityBlit Formatter Unbounded Allocation Vulnerability

More from this source