CVE-2026-72854
Received Received - Intake

Heap Buffer Overflow in msgpack-c Library

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: VulnCheck

Description
msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the addition in the loop condition is unguarded, so a request near SIZE_MAX wraps: the loop condition is already satisfied, the allocation is performed at the small pre-wrap size, and the function returns true. The caller is told the requested capacity was reserved when it was not, so a subsequent write of the requested length overflows the heap buffer. The library's own example/lib_buffer_unpack.c demonstrates the reserve-then-write pattern, and its defensive assert comparing capacity against the request is compiled out under NDEBUG. msgpack-c's own decode entry points do not derive the reservation size from untrusted input, so reaching this requires an integration that passes an attacker-influenced length to the reservation API, such as a length-prefixed streaming transport.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-72854
EUVD
EUVD-2026-63537

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
msgpack msgpack-c From 7.0.1 (inc)
msgpack msgpack-c *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-787 The product writes data past the end, or before the beginning, of the intended buffer.
CWE-190 The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-72854 is an integer overflow vulnerability in the msgpack-c library's msgpack_unpacker_expand_buffer function. When a request near SIZE_MAX is made, the function incorrectly calculates buffer size due to an unchecked addition, leading to a smaller buffer than requested. The function falsely reports success, causing subsequent writes to overflow the heap buffer.

Detection Guidance

To detect this vulnerability, inspect applications using msgpack-c versions 7.0.1 or earlier for the vulnerable reserve-then-write pattern. Check for integer overflows in buffer size calculations near SIZE_MAX. Review logs for heap buffer overflow errors or crashes during MessagePack data processing.

Impact Analysis

This vulnerability can lead to heap buffer overflows, potentially allowing attackers to execute arbitrary code, crash applications, or cause denial-of-service conditions. Systems integrating msgpack-c with untrusted input influencing buffer reservations are particularly at risk.

Compliance Impact

This vulnerability could lead to heap buffer overflows, potentially exposing sensitive data or causing application crashes. For GDPR, this may violate integrity and confidentiality principles if personal data is compromised. HIPAA could be affected if protected health information is exposed or altered due to buffer overflows in systems handling medical data.

Mitigation Strategies

Update msgpack-c to the latest patched version. If updating is not possible, implement bounds checking before size additions in msgpack_unpacker_reserve_buffer. Add post-condition checks to verify reserved buffer sizes match requests. Disable NDEBUG to enable defensive asserts in example code.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-72854. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart