CVE-2026-72854 msgpack CVE debrief

Who should care

Defenders responsible for systems using the msgpack-c library, especially those using integration that passes an attacker-influenced length to the reservation API, should assess exposure and prioritize verification and potential updates.

Why it matters

The vulnerability in msgpack-c library can lead to a heap buffer overflow, allowing potential attackers to exploit the system. Defenders should prioritize verifying the library version, assessing exposure, and ensuring proper input validation.

• Potential heap buffer overflow due to unchecked size_t addition
• False success undersized reservation can lead to subsequent write overflow
• Verification of msgpack-c library version and exposure in systems is necessary
• Input validation and monitoring for potential exploitation attempts are crucial

Technical summary

The msgpack_unpacker_expand_buffer function in src/unpack.c computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. This can lead to a heap buffer overflow when an attacker-influenced length is passed to the reservation API. The vulnerability arises from an unchecked size_t addition in the loop condition, which can cause a wrap-around near SIZE_MAX, resulting in a false success undersized reservation. The library's own example/lib_buffer_unpack.c demonstrates the reserve-then-write pattern, and its defensive assert comparing capacity against the request is compiled out under NDEBUG. msgpack-c's own decode entry points do not derive the reservation size

Defensive priority

Defenders should prioritize verifying the msgpack-c library version and assessing exposure in their systems, especially those using integration that passes an attacker-influenced length to the reservation API.

Recommended defensive actions

• Verify msgpack-c library version and assess exposure in systems using integration that passes an attacker-influenced length to the reservation API
• Review code for vulnerable patterns and ensure proper input validation
• Monitor for potential exploitation attempts and update systems accordingly
• Perform a thorough review of system configurations and identify potential entry points for attackers
• Develop and implement compensating controls to mitigate potential impacts
• Conduct regular security audits to detect and address vulnerabilities
• Establish a process for tracking and addressing exceptions and retesting remediated assets

Evidence notes

The CVE record and NVD vulnerability detail provide information on the vulnerability, while source references offer insights into the affected code and potential exploitation. However, the corpus does not establish versions, exploitation, impact, or remediation, which require verification from the supplied official sources.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.