# CVE-2026-48502: MessagePack for C# stack overflow in MessagePackReader.ReadDateTime

Source: https://junglewise.ai/threats/cve-2026-48502-messagepack-for-c-stack-overflow-in-messagepackreader  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-22. Updated: 2026-06-25  
License: CC BY 4.0 with a link back

CVE-2026-48502 · Severity: high · CVSS 4 · Published 2026-06-22

A vulnerability in the MessagePack-CSharp library, which is used to efficiently exchange data between applications, can allow an attacker to crash a server. By sending a specially crafted message containing a date or time field, an attacker can force the application to exhaust its memory, leading to an immediate shutdown. This results in a denial-of-service, disrupting operations and potentially affecting business availability.

Technologies: [MessagePack-CSharp MessagePack for C#](https://junglewise.ai/threats/technologies/messagepack-for-c), [MessagePack (NuGet)](https://junglewise.ai/threats/technologies/messagepack). Vendors: [MessagePack-CSharp](https://junglewise.ai/threats/vendors/messagepack-csharp), [NuGet](https://junglewise.ai/threats/vendors/nuget).

## Quick answers

**Is CVE-2026-48502 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-48502 being exploited in the wild.

**How severe is CVE-2026-48502?** High severity, with a CVSS score of 4, published 22 June 2026.

**Which products and versions are affected?** MessagePack-CSharp MessagePack for C# < 2.5.301, [3.0, 3.1.7); MessagePack (NuGet) >= 3.0, < 3.1.7, ECOSYSTEM:introduced=3.0,fixed=3.1.7.

**Is there a fix for CVE-2026-48502?** Yes. MessagePack (NuGet): upgrade to 3.1.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-48502 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-48502?** Check whether you run MessagePack-CSharp MessagePack for C# or MessagePack (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- MessagePack (NuGet): upgrade to 3.1.7 or later

  ```sh
  dotnet add package MessagePack --version 3.1.7
  ```


## Technical details

A stack overflow vulnerability exists in MessagePack-CSharp's MessagePackReader.ReadDateTime() method. The root cause is the use of 'stackalloc' with an attacker-controlled length from the MessagePack extension header before the length is validated against valid timestamp sizes. An attacker can provide a small payload that declares a large extension body, forcing a large single-frame stack allocation that triggers an uncatchable StackOverflowException. This bypasses standard security mitigations like MaximumObjectGraphDepth because it does not rely on recursion. The issue is fixed in version 3.1.7 by validating extension lengths before allocation.

## Affected products

- MessagePack-CSharp MessagePack >= 3.0, < 3.1.7

## Identifiers

- CVE-2026-48502
- GHSA-382j-8mxh-c7x2

## Timeline

- 2026-06-09: disclosed: Advisory published by AArnott
- 2026-06-22: advisory: NVD publication date
- 2026-06-25: advisory: GitHub Advisory Database publication date

## References

- [https://api.github.com/users/AArnott](https://api.github.com/users/AArnott)
- [https://github.com/AArnott](https://github.com/AArnott)
- [https://api.github.com/users/AArnott/gists%7B/gist_id%7D](https://api.github.com/users/AArnott/gists%7B/gist_id%7D)
- [https://api.github.com/users/AArnott/repos](https://api.github.com/users/AArnott/repos)
- [https://avatars.githubusercontent.com/u/3548?v=4](https://avatars.githubusercontent.com/u/3548?v=4)
- [https://api.github.com/users/AArnott/events%7B/privacy%7D](https://api.github.com/users/AArnott/events%7B/privacy%7D)

## Related threats

- [MessagePack-CSharp memory exhaustion in nested array deserialization](https://junglewise.ai/threats/cve-2026-92707-messagepack-nested-arrays-can-blow-past-buffer-length-limits)
- [MessagePack for C# security bypass in typeless deserialization](https://junglewise.ai/threats/cve-2026-48517-messagepack-for-c-security-bypass-in-typeless-deserialization)
- [MessagePack for C# hash-collision DoS in InterfaceLookupFormatter](https://junglewise.ai/threats/cve-2026-48516-messagepack-for-c-hash-collision-dos-in-interfacelookupformatter)
- [MessagePack for C# resource exhaustion in multi-dimensional array formatters](https://junglewise.ai/threats/cve-2026-48515-messagepack-for-c-resource-exhaustion-in-multi-dimensional-array)
- [MessagePack for C# denial of service in UnsafeBlitFormatterBase](https://junglewise.ai/threats/cve-2026-48514-messagepack-for-c-denial-of-service-in-unsafeblitformatterbase)