CVE-2026-54522 Details
Description
MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.
A use-after-free vulnerability has been identified in MessagePack for Ruby, specifically in versions prior to 1.8.2. The issue arises in the Buffer#clear method, which fails to properly reset the buffer's memory management pointers after returning a memory page to the shared pool. This oversight allows a subsequent write operation to access stale data from the freed page, leading to a situation where two Buffer instances can alias the same memory. As a result, this vulnerability can cause cross-buffer information disclosure or data corruption.
Users can upgrade to MessagePack for Ruby version 1.8.2 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 30, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-4mrv-5p47-p938 | CISA-ADP | ExploitVendor Advisory |
| https://github.com/msgpack/msgpack-ruby/commit/5627d71606b565641d2dd501b82aae862f4abe90 | [email protected] | Patch |
| https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-4mrv-5p47-p938 | [email protected] | ExploitVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-416 | Use After Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| msgpack messagepack | < 1.8.2 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | Initial Analysis | [email protected] |
| Jul 30, 2026 | CVE Modified | CISA-ADP |
| Jul 30, 2026 | New CVE Received | [email protected] |