CVE-2026-48514: MessagePack for C# denial of service in UnsafeBlitFormatterBase

Executive brief

A vulnerability in the MessagePack-CSharp library for Unity can allow a malicious user to crash a game client or server. By sending a specially crafted, small network message that claims to be very large, the attacker forces the application to exhaust its memory. This can lead to service outages or game crashes, particularly in multiplayer environments.

Technical details

The vulnerability exists in UnsafeBlitFormatterBase<T>.Deserialize within the MessagePack.UnityClient package. The component reads an attacker-controlled byteLength from an extension payload and performs an array allocation before validating that the declared length matches the actual available input or the extension header. An attacker can send a small payload with a large declared length to trigger an OutOfMemoryException or process termination. This affects applications using UnityBlitResolver or UnityBlitWithPrimitiveArrayResolver. Patches are available in versions 2.5.301 and 3.1.7.

Affected products

• MessagePack-CSharp MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7

Timeline

• 2026-06-09: disclosed
• 2026-06-22: advisory: NVD publication date
• 2026-06-25: advisory: GitHub Advisory published

References

• https://api.github.com/users/AArnott
• https://github.com/AArnott
• https://api.github.com/users/AArnott/gists%7B/gist_id%7D
• https://api.github.com/users/AArnott/repos
• https://avatars.githubusercontent.com/u/3548?v=4
• https://api.github.com/users/AArnott/events%7B/privacy%7D