CVE-2026-48514: MessagePack for C# denial of service in UnsafeBlitFormatterBase

CVE-2026-48514 · Severity: medium · CVSS 4 · Published 2026-06-22

A vulnerability in the MessagePack-CSharp library for Unity can allow a malicious user to crash a game client or server. By sending a specially crafted, small network message that claims to be very large, the attacker forces the application to exhaust its memory. This can lead to service outages or game crashes, particularly in multiplayer environments.

Technologies: MessagePack-CSharp MessagePack for C#, MessagePack-CSharp, MessagePack (NuGet). Vendors: MessagePack-CSharp, NuGet.

Quick answers

Is CVE-2026-48514 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-48514 being exploited in the wild.
How severe is CVE-2026-48514?
Medium severity, with a CVSS score of 4, published 22 June 2026.
Which products and versions are affected?
MessagePack-CSharp MessagePack for C# < 2.5.301, >= 3.0.0 < 3.1.7; MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7; MessagePack (NuGet) ECOSYSTEM:introduced=0,fixed=2.5.301.
Is there a fix for CVE-2026-48514?
Yes. MessagePack (NuGet): upgrade to 2.5.301 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-48514 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-48514?
Check whether you run MessagePack-CSharp MessagePack for C#, MessagePack-CSharp or MessagePack (NuGet) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • MessagePack (NuGet): upgrade to 2.5.301 or later
    dotnet add package MessagePack --version 2.5.301

Technical details

The vulnerability exists in UnsafeBlitFormatterBase<T>.Deserialize within the MessagePack.UnityClient package. The component reads an attacker-controlled byteLength from an extension payload and performs an array allocation before validating that the declared length matches the actual available input or the extension header. An attacker can send a small payload with a large declared length to trigger an OutOfMemoryException or process termination. This affects applications using UnityBlitResolver or UnityBlitWithPrimitiveArrayResolver. Patches are available in versions 2.5.301 and 3.1.7.

Affected products

  • MessagePack-CSharp MessagePack-CSharp < 2.5.301, >= 3.0, < 3.1.7

Identifiers

  • CVE-2026-48514
  • GHSA-w567-gjr2-hm5j

Timeline

  • 2026-06-09: disclosed
  • 2026-06-22: advisory: NVD publication date
  • 2026-06-25: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.