CVE-2026-48502

Name of the Vulnerable Software and Affected Versions MessagePack for C# versions prior to 2.5.301 MessagePack for C# versions prior to 3.1.7

Description MessagePack for C# is a MessagePack serializer for C#. The ReadDateTime() function in MessagePackReader can allocate stack memory based on an attacker-controlled MessagePack extension length. During the slow path for timestamp extension parsing, the computed tokenSize includes the extension body length from the wire and is used in a stackalloc operation before the extension length is validated against valid timestamp sizes. A small payload can claim a large timestamp extension body, triggering an uncatchable StackOverflowException (a critical error that occurs when the execution stack overflows its allocated memory), which terminates the host process.

Recommendations Update to version 2.5.301. Update to version 3.1.7.