CVE-2026-48515
Received Received - Intake
Memory Corruption in MessagePack for C#

Publication date: 2026-06-22

Last updated on: 2026-06-22

Assigner: GitHub, Inc.

Description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePack-CSharp's multi-dimensional array formatters read dimension lengths directly from the payload and allocate T[,], T[,,], or T[,,,] before validating that the dimension product matches the encoded element count. The formatter reads a guarded element array header, but allocation of the target multi-dimensional array happens before the dimensions are checked against that element count. A small payload can therefore declare large dimensions, provide an empty or tiny inner array, and cause a large heap allocation before element data is validated. This vulnerability is fixed in 2.5.301 and 3.1.7.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-06-22
Last Modified
2026-06-22
Generated
2026-06-23
AI Q&A
2026-06-23
EPSS Evaluated
N/A
NVD
CVE-2026-48515
Affected Vendors & Products
Showing 2 associated CPEs
Vendor Product Version / Range
neuecc messagepack-csharp 2.5.301
neuecc messagepack-csharp 3.1.7
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in MessagePack for C#, specifically in its multi-dimensional array formatters prior to versions 2.5.301 and 3.1.7. The formatter reads dimension lengths directly from the payload and allocates multi-dimensional arrays (such as T[,], T[,,], or T[,,,]) before verifying that the total number of elements matches the encoded element count. Because the allocation happens before validation, an attacker can craft a small payload that declares very large dimensions but provides only a tiny or empty inner array. This causes the program to allocate a large amount of heap memory unnecessarily, potentially leading to resource exhaustion.

Impact Analysis

The vulnerability can lead to excessive memory allocation on the heap, which may cause a denial of service (DoS) condition by exhausting system memory resources. This can degrade system performance or cause the application to crash, impacting availability.

Mitigation Strategies

To mitigate this vulnerability, update MessagePack for C# to version 2.5.301 or 3.1.7 or later, where the issue has been fixed.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-48515. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart