CVE-2026-48109

Name of the Vulnerable Software and Affected Versions MessagePack for C# versions prior to 2.5.301 MessagePack for C# versions prior to 3.1.7

Description An issue exists in the optional LZ4 decompression path used by compression modes Lz4Block and Lz4BlockArray. The decoder uses a deprecated fast-decompression algorithm that lacks a source-length bound. A remote attacker can send a crafted MessagePack payload with manipulated LZ4 token/length fields to cause out-of-bounds reads from the compressed input buffer. This can trigger an AccessViolationException during decompression, leading to process termination and denial of service. In certain conditions, limited unintended memory disclosure from over-read data may occur before the process fails. This affects applications that deserialize untrusted data with LZ4 compression enabled.

Recommendations Update to version 2.5.301 or later. Update to version 3.1.7 or later. Disable LZ4 compression for untrusted input paths (Lz4Block, Lz4BlockArray). Only accept compressed payloads from strongly trusted producers. Isolate deserialization in a separate process or container with restart supervision to limit availability impact.