CVE-2026-88351

Name of the Vulnerable Software and Affected Versions MPack version 1.1.1

Description An integer overflow exists in the MPack Node API on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count, the page allocation size calculation in the mpack tree parse children() function can overflow size t, leading to an undersized allocation. This results in mpack node data t records being written beyond the allocated heap buffer, causing a heap-buffer-overflow, memory corruption, and denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.