CVE-2026-48502 Details
Description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp extension parsing, the computed tokenSize includes the extension body length from the wire and is used in a stackalloc operation before the extension length is validated as one of the valid timestamp sizes. A very small payload can claim a large timestamp extension body and cause a stack allocation large enough to trigger an uncatchable StackOverflowException, terminating the host process. This vulnerability is fixed in 2.5.301 and 3.1.7.
A stack-based buffer overflow vulnerability has been identified in MessagePack for C# versions prior to 2.5.301 and 3.1.7. The issue arises in the 'MessagePackReader.ReadDateTime()' method, where an attacker can manipulate the length of a MessagePack extension. During the parsing of timestamp extensions, the calculated token size includes the extension body length from the MessagePack data, which is then used to allocate stack memory before the length is validated. This flaw allows a small payload to claim a large extension body, leading to a stack allocation that can cause a StackOverflowException, abruptly terminating the host process. The vulnerability is exploitable when deserializing untrusted MessagePack data into types that include DateTime values.
Users are advised to upgrade MessagePack to version 2.5.301 or 3.1.7. For those using companion MessagePack packages, upgrade them to the coordinated patched versions as well. Until a patch is applied, avoid deserializing untrusted MessagePack data into schemas with DateTime or DateTimeOffset fields. Where possible, enforce strict maximum message sizes and reject malformed extension payloads before they are processed by MessagePack-CSharp.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jun 23, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-382j-8mxh-c7x2 | [email protected] | MitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-1188 | Initialization of a Resource with an Insecure Default | [email protected] |
| CWE-125 | Out-of-bounds Read | [email protected] |
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
| CWE-407 | Inefficient Algorithmic Complexity | [email protected] |
| CWE-409 | Improper Handling of Highly Compressed Data (Data Amplification) | [email protected] |
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | [email protected] |
| CWE-502 | Deserialization of Untrusted Data | [email protected] |
| CWE-674 | Uncontrolled Recursion | [email protected] |
| CWE-789 | Memory Allocation with Excessive Size Value | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| messagepack messagepack | < 2.5.301 >= 3.0.3, < 3.1.7 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 23, 2026 | Initial Analysis | [email protected] |
| Jun 23, 2026 | CVE Modified | CISA-ADP |
| Jun 22, 2026 | New CVE Received | [email protected] |