CVE-2026-72854

Name of the Vulnerable Software and Affected Versions msgpack-c (affected versions not specified)

Description An integer overflow occurs in the msgpack unpacker expand buffer function within src/unpack.c, which is accessible via the msgpack unpacker reserve buffer API. The function calculates the new buffer size using an unchecked size t addition of the requested size and the amount already used. When a request near SIZE MAX is made, the addition wraps, causing the loop condition to be satisfied prematurely. Consequently, the allocation is performed at a small pre-wrap size, but the function returns a success status. This leads the caller to believe the requested capacity was reserved, resulting in a heap buffer overflow during subsequent write operations. This issue can be triggered in integrations that pass attacker-influenced lengths to the reservation API, such as length-prefixed streaming transports.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.