CVE-2026-54522

Awaiting Analysis Awaiting Analysis - Queue

MessagePack for Ruby Buffer Data Disclosure Vulnerability

Publication date: 2026-07-30

Last updated on: 2026-07-30

Assigner: GitHub, Inc.

Description

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-30

Last Modified

2026-07-30

Generated

2026-07-31

AI Q&A

2026-07-31

EPSS Evaluated

N/A

NVD

CVE-2026-54522

EUVD

EUVD-2026-51235

Affected Vendors & Products

Vendor	Product	Version / Range
msgpack	messagepack	1.8.2

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-416	The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Attack-Flow Graph

Executive Summary

This vulnerability affects MessagePack for Ruby versions before 1.8.2. It involves a flaw in the MessagePack::Buffer#clear function where internal pointers (rmem_last, rmem_end, rmem_owner) are not properly reset after memory is returned to a shared pool. This can lead to memory aliasing issues where different buffers incorrectly share the same memory page, potentially causing data disclosure or corruption across buffers.

Detection Guidance

This vulnerability affects MessagePack for Ruby versions prior to 1.8.2. Detection involves checking the installed version of the msgpack gem. Run: gem list msgpack. If the version is less than 1.8.2, the system is vulnerable.

Impact Analysis

If exploited, this vulnerability could allow an attacker to read or modify data from other buffers that are not intended to be accessible. This might lead to unauthorized access to sensitive information or unintended data corruption in applications using affected MessagePack versions.

Compliance Impact

This vulnerability could impact compliance by potentially exposing sensitive data, which is a violation of GDPR and HIPAA requirements for data protection and confidentiality. Organizations using vulnerable versions may face legal and regulatory penalties due to unauthorized data access or leaks.

Mitigation Strategies

Upgrade MessagePack for Ruby to version 1.8.2 or later. Use: gem install msgpack -v '>=1.8.2'. Verify the update with gem list msgpack. Restart affected applications to ensure the fix is applied.

Hi! I’m here to help you understand CVE-2026-54522. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70