Executive brief
MessagePack-C is a binary serialization library used in many applications to exchange data efficiently. A vulnerability in the buffer expansion function allows an attacker to cause a heap buffer overflow by requesting a very large buffer size that wraps around when calculated, resulting in a smaller allocation than promised. This could lead to memory corruption and potentially arbitrary code execution if an attacker can influence the buffer reservation size through length-prefixed input data.
Technical details
The vulnerability is an integer overflow in msgpack_unpacker_expand_buffer (src/unpack.c) reached via the public msgpack_unpacker_reserve_buffer API. When computing the new buffer size, an unchecked size_t addition of the requested size and the amount already used can overflow. The doubling loop guards its multiplication against overflow, but the loop condition itself performs an unguarded addition, causing a request near SIZE_MAX to wrap around. The function returns true, falsely indicating the requested capacity was reserved, but the actual allocation is smaller. A subsequent write of the requested length then overflows the heap buffer. The vulnerability requires an integration that passes attacker-controlled length values to the reservation API, such as a length-prefixed streaming transport. MessagePack-C's own decode entry points do not derive reservation sizes from untrusted input, making this a library-level issue exposed through certain usage patterns.
Affected products
- MessagePack msgpack-c <UNKNOWN>
Timeline
- 2026-08-20: disclosed