CVE-2026-88351 Details
Description
An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count, the page allocation size calculation in mpack_tree_parse_children() can overflow size_t and produce an undersized allocation. Subsequent parsing writes mpack_node_data_t records beyond the allocated heap buffer, resulting in heap-buffer-overflow, memory corruption, and denial of service.
A vulnerability allowing heap buffer overflow through integer overflow has been identified in the MPack Node API, specifically in version 1.1.1 on 32-bit platforms. The issue arises when the parser processes a specially crafted MessagePack array32 or map32 object with an excessively large element count. This causes the page allocation size calculation to overflow, leading to an undersized allocation. Consequently, the parser writes data beyond the allocated buffer, causing memory corruption and a denial-of-service condition.
Users are advised to update to MPack version 1.1.2, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 24, 2026CISA-ADP
Assessed Sep 25, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ludocode/mpack/issues/123 | CISA-ADP | ExploitIssue TrackingTechnical DescriptionVendor |
| https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b | [email protected] | Source CodeVendor |
| https://github.com/ludocode/mpack/issues/123 | [email protected] | ExploitIssue TrackingTechnical DescriptionVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| ludocode MPack | 1.1.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 25, 2026 | CVE Modified | CISA-ADP |
| Sep 24, 2026 | New CVE Received | [email protected] |