CVE-2026-44375

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-44375", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-05-05T20:15:20.631Z", "datePublished": "2026-05-14T14:32:09.506Z", "dateUpdated": "2026-05-14T16:02:12.327Z"}, "containers": {"cna": {"title": "Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException", "problemTypes": [{"descriptions": [{"cweId": "CWE-789", "lang": "en", "description": "CWE-789: Memory Allocation with Excessive Size Value", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/AArnott/Nerdbank.MessagePack/security/advisories/GHSA-2cwq-pwfr-wcw3", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/AArnott/Nerdbank.MessagePack/security/advisories/GHSA-2cwq-pwfr-wcw3"}, {"name": "https://github.com/AArnott/Nerdbank.MessagePack/pull/941", "tags": ["x_refsource_MISC"], "url": "https://github.com/AArnott/Nerdbank.MessagePack/pull/941"}, {"name": "https://github.com/AArnott/Nerdbank.MessagePack/commit/7d1eb319cfabe7280e70699946c9a48579fa2f30", "tags": ["x_refsource_MISC"], "url": "https://github.com/AArnott/Nerdbank.MessagePack/commit/7d1eb319cfabe7280e70699946c9a48579fa2f30"}, {"name": "https://github.com/AArnott/Nerdbank.MessagePack/releases/tag/v1.1.62", "tags": ["x_refsource_MISC"], "url": "https://github.com/AArnott/Nerdbank.MessagePack/releases/tag/v1.1.62"}], "affected": [{"vendor": "AArnott", "product": "Nerdbank.MessagePack", "versions": [{"version": "< 1.1.62", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-14T14:32:09.506Z"}, "descriptions": [{"lang": "en", "value": "Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, causing the reader to allocate an attacker-controlled number of bytes on the stack. This can trigger a StackOverflowException, which is not catchable by user code and terminates the process. This vulnerability is fixed in 1.1.62."}], "source": {"advisory": "GHSA-2cwq-pwfr-wcw3", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-05-14T16:01:58.538455Z", "id": "CVE-2026-44375", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T16:02:12.327Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-44375", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-14T16:01:58.538455Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-05-14T16:02:08.172Z"}}], "cna": {"title": "Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException", "source": {"advisory": "GHSA-2cwq-pwfr-wcw3", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "AArnott", "product": "Nerdbank.MessagePack", "versions": [{"status": "affected", "version": "< 1.1.62"}]}], "references": [{"url": "https://github.com/AArnott/Nerdbank.MessagePack/security/advisories/GHSA-2cwq-pwfr-wcw3", "name": "https://github.com/AArnott/Nerdbank.MessagePack/security/advisories/GHSA-2cwq-pwfr-wcw3", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/AArnott/Nerdbank.MessagePack/pull/941", "name": "https://github.com/AArnott/Nerdbank.MessagePack/pull/941", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/AArnott/Nerdbank.MessagePack/commit/7d1eb319cfabe7280e70699946c9a48579fa2f30", "name": "https://github.com/AArnott/Nerdbank.MessagePack/commit/7d1eb319cfabe7280e70699946c9a48579fa2f30", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/AArnott/Nerdbank.MessagePack/releases/tag/v1.1.62", "name": "https://github.com/AArnott/Nerdbank.MessagePack/releases/tag/v1.1.62", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, causing the reader to allocate an attacker-controlled number of bytes on the stack. This can trigger a StackOverflowException, which is not catchable by user code and terminates the process. This vulnerability is fixed in 1.1.62."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-789", "description": "CWE-789: Memory Allocation with Excessive Size Value"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-05-14T14:32:09.506Z"}}}, "cveMetadata": {"cveId": "CVE-2026-44375", "state": "PUBLISHED", "dateUpdated": "2026-05-14T16:02:12.327Z", "dateReserved": "2026-05-05T20:15:20.631Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-05-14T14:32:09.506Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "Nerdbank.MessagePack", "vendor": "AArnott", "versions": [{"status": "affected", "version": "< 1.1.62"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, causing the reader to allocate an attacker-controlled number of bytes on the stack. This can trigger a StackOverflowException, which is not catchable by user code and terminates the process. This vulnerability is fixed in 1.1.62."}, {"lang": "es", "value": "Nerdbank.MessagePack es una biblioteca de serializaci\u00f3n MessagePack compatible con NativeAOT. Antes de la versi\u00f3n 1.1.62, Nerdbank.MessagePack contiene una vulnerabilidad de asignaci\u00f3n de pila incontrolada en la decodificaci\u00f3n de DateTime. Una carga \u00fatil MessagePack maliciosa puede declarar una longitud de extensi\u00f3n de marca de tiempo excesiva, lo que hace que el lector asigne un n\u00famero de bytes controlado por el atacante en la pila. Esto puede desencadenar una StackOverflowException, que no es capturable por el c\u00f3digo de usuario y termina el proceso. Esta vulnerabilidad est\u00e1 corregida en la versi\u00f3n 1.1.62."}], "id": "CVE-2026-44375", "lastModified": "2026-10-26T14:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44375", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-05-14T16:01:58.538455Z", "version": "2.0.3"}}]}, "published": "2026-05-14T15:16:48.383", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/AArnott/Nerdbank.MessagePack/commit/7d1eb319cfabe7280e70699946c9a48579fa2f30"}, {"source": "security-advisories@github.com", "url": "https://github.com/AArnott/Nerdbank.MessagePack/pull/941"}, {"source": "security-advisories@github.com", "url": "https://github.com/AArnott/Nerdbank.MessagePack/releases/tag/v1.1.62"}, {"source": "security-advisories@github.com", "url": "https://github.com/AArnott/Nerdbank.MessagePack/security/advisories/GHSA-2cwq-pwfr-wcw3"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-789"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.1.62)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "Nerdbank.MessagePack", "source": "cna", "vendor": "AArnott"}, "product": "nerdbank.messagepack", "vendor": "aarnott"}], "created": "2026-05-14T17:00:15.366391+00:00", "updated": "2026-05-17T17:09:13.876980+00:00", "vendors": ["aarnott", "aarnott$PRODUCT$nerdbank.messagepack"]}