Executive brief
MessagePack for Ruby is a library used to serialize and deserialize data into a compact binary format. A security flaw in how the library manages its internal memory buffers allows data from one buffer to be leaked into or corrupted by another. In practice, this could allow an attacker to access sensitive information or corrupt data belonging to different parts of the same application process.
Technical details
A use-after-free (UAF) vulnerability exists in MessagePack::Buffer#clear within ext/msgpack/buffer.c. When the clear method is called, it returns memory pages to a shared pool but fails to reset internal rmem pointers (rmem_last, rmem_end, and rmem_owner). Consequently, a subsequent write operation may reuse a stale pointer to a freed page. If a second MessagePack::Buffer re-acquires that same page from the pool, both buffers will alias the same physical memory. This allows one buffer to read or overwrite the contents of the other. The issue is fixed in version 1.8.2 by ensuring pointers are properly reset when a buffer is emptied.
Affected products
- msgpack MessagePack for Ruby < 1.8.2
Timeline
- 2026-06-09: advisory: GitHub Security Advisory published
- 2026-07-30: disclosed: CVE published to NVD