CVE-2026-54522

Name of the Vulnerable Software and Affected Versions MessagePack for Ruby versions prior to 1.8.2

Description A use-after-free issue exists in the MessagePack::Buffer#clear function within ext/msgpack/buffer.c. When this function is called, it returns memory pages to a shared pool but fails to reset the buffer's rmem cursor variables rmem last, rmem end, and rmem owner. Consequently, a subsequent call to Buffer#write may reuse a pointer to a page that has already been returned to the pool. If a second MessagePack::Buffer acquires that same page, both buffers will alias the same memory location. This can lead to cross-buffer information disclosure, where one buffer reads data belonging to another, or data corruption, where one buffer overwrites the other's serialized data.

Recommendations Update MessagePack for Ruby to version 1.8.2 or later.