Msgpack C
Monthly
Heap buffer overflow in msgpack-c through version 7.0.1 results from an integer overflow in msgpack_unpacker_expand_buffer, where unchecked size_t addition of the requested reservation size and current buffer usage wraps to near-zero on near-SIZE_MAX inputs, causing the allocator to receive a massively undersized target while the function falsely reports success to the caller. Integrations that pass attacker-controlled lengths to the msgpack_unpacker_reserve_buffer API - such as custom length-prefixed streaming transports - can trigger subsequent heap overwrites when the caller writes the full declared length into the undersized buffer. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires a specific non-default integration pattern not present in msgpack-c's own internal decode paths.
Heap buffer overflow in msgpack-c through version 7.0.1 results from an integer overflow in msgpack_unpacker_expand_buffer, where unchecked size_t addition of the requested reservation size and current buffer usage wraps to near-zero on near-SIZE_MAX inputs, causing the allocator to receive a massively undersized target while the function falsely reports success to the caller. Integrations that pass attacker-controlled lengths to the msgpack_unpacker_reserve_buffer API - such as custom length-prefixed streaming transports - can trigger subsequent heap overwrites when the caller writes the full declared length into the undersized buffer. No public exploit code or CISA KEV listing exists at time of analysis; exploitation requires a specific non-default integration pattern not present in msgpack-c's own internal decode paths.