Read the docs
TI-2026-35863 Aliases CVE-2026-48502GHSA-382j-8mxh-c7x2

Out-of-bounds read in MessagePack-CSharp

Priority LOW 36CWE-1188Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Attack requirements
Present
Impact type
Denial of service, Code execution
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-125, CWE-502 and the CVSS impact.

Summary

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp extension parsing, the computed tokenSize includes the extension body length from the wire and is used in a stackalloc operation before the extension length is validated as one of the valid timestamp sizes. A very small payload can claim a large timestamp extension body and cause a stack allocation large enough to trigger an uncatchable StackOverflowException, terminating the host process. This vulnerability is fixed in 2.5.301 and 3.1.7.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00437 38th percentileScored 2026-11-07
Fix Fixed MessagePack-CSharp (MessagePack-CSharp): 3.1.7, 2.5.301MessagePack (NuGet): 3.1.7

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MessagePack-CSharpMessagePack-CSharp3.1.7 to before 3.1.7; before 2.5.3013.1.7, 2.5.301Patch availableCNA
—MessagePack (NuGet)3.0 to before 3.1.73.1.7Patch availableGHSA-382j-8mxh-c7x2
  • MessagePack-CSharp VendorMessagePack-CSharp Affected 3.1.7 to before 3.1.7; before 2.5.301 Fixed in 3.1.7, 2.5.301 Patch available CNA
  • MessagePack (NuGet) Vendor— Affected 3.0 to before 3.1.7 Fixed in 3.1.7 Patch available GHSA-382j-8mxh-c7x2

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:messagepack:messagepack:*:*:*:*:*:c\#:*:*before 2.5.301; 3.0.3 to before 3.1.7VulnerableMessagePack-CSharp
  • cpe:2.3:a:messagepack:messagepack:*:*:*:*:*:c\#:*:* Versions before 2.5.301; 3.0.3 to before 3.1.7 Vulnerable ·MessagePack-CSharp

Remediation

  • Fix · CNA MessagePack-CSharp (MessagePack-CSharp) Fixed in 3.1.7, 2.5.301
  • Fix · GHSA-382j-8mxh-c7x2 MessagePack (NuGet) Fixed in 3.1.7 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-48502
  2. 2026-10-03 Alias added: GHSA-382j-8mxh-c7x2

References

Advisory 2

Other 1

  • TI-2026-35549 MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input CVSS 3.1HIGH 8.2
  • TI-2026-35866 MessagePack-CSharp: MessagePackReader.Skip can recurse without enforcing maximum object graph depth CVSS 3.1HIGH 7.5
  • TI-2026-35873 MessagePack-CSharp: DynamicUnionResolver generated deserializers miss depth enforcement CVSS 4.0MEDIUM 6.3
  • TI-2020-04290 Untrusted data can lead to DoS attack in MessagePack for C# and Unity CVSS 3.1MEDIUM 6.5
  • TI-2026-35877 MessagePack-CSharp: Typeless deserialization type restrictions do not recurse into arrays or generic arguments CVSS 4.0MEDIUM 6.3
  • TI-2026-35876 MessagePack-CSharp: InterfaceLookupFormatter bypasses collision-resistant comparer settings CVSS 4.0MEDIUM 6.3
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences