CVE-2026-88351
Received Received - Intake

Integer Overflow in MPack Node API Leading to Heap Buffer Overflow

Publication date: 2026-09-24

Last updated on: 2026-09-24

Assigner: MITRE

Description
An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count, the page allocation size calculation in mpack_tree_parse_children() can overflow size_t and produce an undersized allocation. Subsequent parsing writes mpack_node_data_t records beyond the allocated heap buffer, resulting in heap-buffer-overflow, memory corruption, and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-24
Last Modified
2026-09-24
Generated
2026-09-24
AI Q&A
2026-09-24
EPSS Evaluated
N/A
NVD
CVE-2026-88351
EUVD
EUVD-2026-86022

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ludocode mpack 1.1.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an integer overflow in the MPack Node API affecting 32-bit platforms. When parsing a crafted MessagePack array32 or map32 object with an extremely large element count, the allocation size calculation overflows and produces an undersized buffer. This leads to heap-buffer-overflow, memory corruption, and denial of service.

Detection Guidance

To detect this vulnerability, monitor for heap-buffer-overflow errors during MessagePack parsing on 32-bit systems. Use tools like AddressSanitizer (ASan) with a 32-bit build of MPack. Test with a crafted payload containing an array32 header specifying 0x10000001 elements followed by data.

Impact Analysis

An attacker could exploit this to cause memory corruption, execute arbitrary code, or crash applications using MPack 1.1.1 on 32-bit systems. The issue allows writing beyond allocated memory by supplying specially crafted data.

Mitigation Strategies

Immediately upgrade to a patched version of MPack with overflow checks if available. If not, apply the commit 3d54d12 or implement custom 64-bit overflow checks before page allocation. Avoid parsing untrusted MessagePack data on 32-bit platforms until fixed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88351. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart