CVE-2026-88351

Deferred Deferred - Pending Action

Integer Overflow in MPack Node API Leading to Heap Buffer Overflow

Publication date: 2026-09-24

Last updated on: 2026-09-25

Assigner: MITRE

Description

An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count, the page allocation size calculation in mpack_tree_parse_children() can overflow size_t and produce an undersized allocation. Subsequent parsing writes mpack_node_data_t records beyond the allocated heap buffer, resulting in heap-buffer-overflow, memory corruption, and denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-24

Last Modified

2026-09-25

Generated

2026-10-15

AI Q&A

2026-09-24

EPSS Evaluated

2026-10-13

NVD

CVE-2026-88351

EUVD

EUVD-2026-86022

Affected Vendors & Products

Vendor	Product	Version / Range
ludocode	mpack	1.1.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability is an integer overflow in the MPack Node API affecting 32-bit platforms. When parsing a crafted MessagePack array32 or map32 object with an extremely large element count, the allocation size calculation overflows and produces an undersized buffer. This leads to heap-buffer-overflow, memory corruption, and denial of service.

Detection Guidance

To detect this vulnerability, monitor for heap-buffer-overflow errors during MessagePack parsing on 32-bit systems. Use tools like AddressSanitizer (ASan) with a 32-bit build of MPack. Test with a crafted payload containing an array32 header specifying 0x10000001 elements followed by data.

Impact Analysis

An attacker could exploit this to cause memory corruption, execute arbitrary code, or crash applications using MPack 1.1.1 on 32-bit systems. The issue allows writing beyond allocated memory by supplying specially crafted data.

Compliance Impact

This vulnerability could lead to denial of service or remote code execution due to heap-buffer-overflow, which may compromise data integrity and availability. For GDPR, this could result in unauthorized access to personal data, violating confidentiality and integrity principles. For HIPAA, it may risk unauthorized disclosure of protected health information, impacting compliance with security and privacy requirements.

Mitigation Strategies

Immediately upgrade to a patched version of MPack with overflow checks if available. If not, apply the commit 3d54d12 or implement custom 64-bit overflow checks before page allocation. Avoid parsing untrusted MessagePack data on 32-bit platforms until fixed.

Hi! I’m here to help you understand CVE-2026-88351. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70