Mpack
Monthly
Integer overflow in MPack 1.1.1's mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc() helpers causes the allocation size computation (node.data->len + 1) to wrap to zero when a parsed MessagePack node advertises a length of SIZE_MAX, yielding an undersized buffer allocation and, in the officially scored path, a denial-of-service/crash. Exploitation requires the consuming application to use MPack's node/tree reader API and to call one of these helpers on a node whose length is attacker-controlled; it is realistically reachable on 32-bit platforms where SIZE_MAX equals UINT32_MAX (~4 GB) and generally infeasible on 64-bit platforms. The assessed vector is local (AV:L) with high attack complexity (AC:H) and no authentication or user interaction requirement (PR:N/UI:N), so remote reachability depends entirely on whether the host application exposes the parser to untrusted network input; there is no public exploit identified at time of analysis and EPSS is low at 0.20% (10th percentile).
Integer overflow in MPack 1.1.1's mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc() helpers causes the allocation size computation (node.data->len + 1) to wrap to zero when a parsed MessagePack node advertises a length of SIZE_MAX, yielding an undersized buffer allocation and, in the officially scored path, a denial-of-service/crash. Exploitation requires the consuming application to use MPack's node/tree reader API and to call one of these helpers on a node whose length is attacker-controlled; it is realistically reachable on 32-bit platforms where SIZE_MAX equals UINT32_MAX (~4 GB) and generally infeasible on 64-bit platforms. The assessed vector is local (AV:L) with high attack complexity (AC:H) and no authentication or user interaction requirement (PR:N/UI:N), so remote reachability depends entirely on whether the host application exposes the parser to untrusted network input; there is no public exploit identified at time of analysis and EPSS is low at 0.20% (10th percentile).