Github Com Shamaton Msgpack CVE-2026-32284

The msgpack binary serialization format defines fixed extension (fixext) types using format codes 0xd4 through 0xd8, each with predefined payload sizes. The shamaton/msgpack Go library decoder processes these types but does not properly verify that sufficient bytes remain in the input buffer before attempting to read the expected payload length. This is a classic buffer bounds-checking failure (CWE category: improper input validation). The affected CPE entries indicate all major versions of the library are impacted: cpe:2.3:a:github.com/shamaton/msgpack, cpe:2.3:a:github.com/shamaton/msgpack/v2, and cpe:2.3:a:github.com/shamaton/msgpack/v3. The root cause is the decoder's assumption that the input buffer contains complete msgpack frames without validation, leading to attempted reads beyond allocated memory regions.