A Arnott

**Name of the Vulnerable Software and Affected Versions** MessagePack for C# versions prior to 2.5.301 MessagePack for C# versions prior to 3.1.7 **Description** MessagePack for C# is a MessagePack serializer for C#. The `ReadDateTime()` function in `MessagePackReader` can allocate stack memory based on an attacker-controlled MessagePack extension length. During the slow path for timestamp extension parsing, the computed `tokenSize` includes the extension body length from the wire and is used in a `stackalloc` operation before the extension length is validated against valid timestamp sizes. A small payload can claim a large timestamp extension body, triggering an uncatchable StackOverflowException (a critical error that occurs when the execution stack overflows its allocated memory), which terminates the host process. **Recommendations** Update to version 2.5.301. Update to version 3.1.7.