Executive brief
MessagePack for C# is a high-performance library used to convert data into a compact binary format for storage or transmission. A security flaw in its data compression feature allows an attacker to send a specially crafted message that crashes the application. In some cases, this could also lead to the accidental exposure of small amounts of sensitive information from the computer's memory.
Technical details
An out-of-bounds read vulnerability exists in the LZ4 decompression implementation of MessagePack for C#. The root cause is the use of a deprecated fast-decompression algorithm that lacks source-length bound checks. A remote, unauthenticated attacker can exploit this by sending a crafted MessagePack payload with manipulated LZ4 token or length fields. This can result in an AccessViolationException, leading to process termination (Denial of Service), and potentially limited memory disclosure of over-read data. The issue is fixed in versions 2.5.301 and 3.1.7.
Affected products
- MessagePack-CSharp MessagePack for C# < 2.5.301, >= 3.0.0 < 3.1.7
Timeline
- 2026-06-09: advisory: GitHub advisory published
- 2026-06-22: disclosed: NVD publication date