CVE-2026-72854

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-72854", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-08-10T15:16:31.371Z", "datePublished": "2026-08-20T18:19:24.266Z", "dateUpdated": "2026-09-24T14:19:03.146Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-24T14:19:03.146Z"}, "datePublic": "2026-08-13T00:00:00.000Z", "title": "msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation", "descriptions": [{"lang": "en", "value": "msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the addition in the loop condition is unguarded, so a request near SIZE_MAX wraps: the loop condition is already satisfied, the allocation is performed at the small pre-wrap size, and the function returns true. The caller is told the requested capacity was reserved when it was not, so a subsequent write of the requested length overflows the heap buffer. The library's own example/lib_buffer_unpack.c demonstrates the reserve-then-write pattern, and its defensive assert comparing capacity against the request is compiled out under NDEBUG. msgpack-c's own decode entry points do not derive the reservation size from untrusted input, so reaching this requires an integration that passes an attacker-influenced length to the reservation API, such as a length-prefixed streaming transport."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Integer Overflow or Wraparound", "cweId": "CWE-190", "type": "CWE"}]}, {"descriptions": [{"lang": "en", "description": "Out-of-bounds Write", "cweId": "CWE-787", "type": "CWE"}]}], "affected": [{"vendor": "msgpack", "product": "msgpack-c", "defaultStatus": "unaffected", "repo": "https://github.com/msgpack/msgpack-c", "versions": [{"version": "0", "lessThanOrEqual": "7.0.1", "status": "affected", "versionType": "custom"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L", "attackVector": "LOCAL", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "attackVector": "LOCAL", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 5.8, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/msgpack/msgpack-c/issues/1181", "tags": ["issue-tracking"], "name": "GitHub Issue #1181"}, {"url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/src/unpack.c#L429-L502", "tags": ["technical-description"], "name": "msgpack_unpacker_expand_buffer at c-7.0.1"}, {"url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/include/msgpack/unpack.h#L219-L223", "tags": ["technical-description"], "name": "msgpack_unpacker_reserve_buffer capacity contract at c-7.0.1"}, {"url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/example/lib_buffer_unpack.c", "tags": ["technical-description"], "name": "Shipped example demonstrating the reserve-then-write pattern"}, {"url": "https://github.com/msgpack/msgpack-c", "tags": ["product"]}, {"name": "VulnCheck Advisory: msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/msgpack-c-integer-overflow-in-msgpack-unpacker-expand-buffer-causes-a-false-success-undersized-reservation"}], "credits": [{"lang": "en", "value": "mtholmquist", "type": "finder"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/msgpack/msgpack-c/issues/1181", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-20T18:52:52.984726Z", "id": "CVE-2026-72854", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T18:53:26.891Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-72854", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-20T18:52:52.984726Z"}}}], "references": [{"url": "https://github.com/msgpack/msgpack-c/issues/1181", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-20T18:53:19.871Z"}}], "cna": {"title": "msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation", "credits": [{"lang": "en", "type": "finder", "value": "mtholmquist"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "LOW", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 5.8, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "LOW", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}], "affected": [{"repo": "https://github.com/msgpack/msgpack-c", "vendor": "msgpack", "product": "msgpack-c", "versions": [{"status": "affected", "version": "0", "versionType": "custom", "lessThanOrEqual": "7.0.1"}], "defaultStatus": "unaffected"}], "datePublic": "2026-08-13T00:00:00.000Z", "references": [{"url": "https://github.com/msgpack/msgpack-c/issues/1181", "name": "GitHub Issue #1181", "tags": ["issue-tracking"]}, {"url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/src/unpack.c#L429-L502", "name": "msgpack_unpacker_expand_buffer at c-7.0.1", "tags": ["technical-description"]}, {"url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/include/msgpack/unpack.h#L219-L223", "name": "msgpack_unpacker_reserve_buffer capacity contract at c-7.0.1", "tags": ["technical-description"]}, {"url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/example/lib_buffer_unpack.c", "name": "Shipped example demonstrating the reserve-then-write pattern", "tags": ["technical-description"]}, {"url": "https://github.com/msgpack/msgpack-c", "tags": ["product"]}, {"url": "https://www.vulncheck.com/advisories/msgpack-c-integer-overflow-in-msgpack-unpacker-expand-buffer-causes-a-false-success-undersized-reservation", "name": "VulnCheck Advisory: msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the addition in the loop condition is unguarded, so a request near SIZE_MAX wraps: the loop condition is already satisfied, the allocation is performed at the small pre-wrap size, and the function returns true. The caller is told the requested capacity was reserved when it was not, so a subsequent write of the requested length overflows the heap buffer. The library's own example/lib_buffer_unpack.c demonstrates the reserve-then-write pattern, and its defensive assert comparing capacity against the request is compiled out under NDEBUG. msgpack-c's own decode entry points do not derive the reservation size from untrusted input, so reaching this requires an integration that passes an attacker-influenced length to the reservation API, such as a length-prefixed streaming transport."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-190", "description": "Integer Overflow or Wraparound"}]}, {"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-787", "description": "Out-of-bounds Write"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-24T14:19:03.146Z"}}}, "cveMetadata": {"cveId": "CVE-2026-72854", "state": "PUBLISHED", "dateUpdated": "2026-09-24T14:19:03.146Z", "dateReserved": "2026-08-10T15:16:31.371Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-08-20T18:19:24.266Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "msgpack-c", "repo": "https://github.com/msgpack/msgpack-c", "vendor": "msgpack", "versions": [{"lessThanOrEqual": "7.0.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the addition in the loop condition is unguarded, so a request near SIZE_MAX wraps: the loop condition is already satisfied, the allocation is performed at the small pre-wrap size, and the function returns true. The caller is told the requested capacity was reserved when it was not, so a subsequent write of the requested length overflows the heap buffer. The library's own example/lib_buffer_unpack.c demonstrates the reserve-then-write pattern, and its defensive assert comparing capacity against the request is compiled out under NDEBUG. msgpack-c's own decode entry points do not derive the reservation size from untrusted input, so reaching this requires an integration that passes an attacker-influenced length to the reservation API, such as a length-prefixed streaming transport."}, {"lang": "es", "value": "msgpack_unpacker_expand_buffer en src/unpack.c, alcanzada a trav\u00e9s de la API p\u00fablica msgpack_unpacker_reserve_buffer, calcula su nuevo tama\u00f1o de b\u00fafer utilizando una adici\u00f3n size_t no verificada del tama\u00f1o solicitado y la cantidad ya utilizada. El bucle de duplicaci\u00f3n protege su propia multiplicaci\u00f3n contra el desbordamiento, pero la adici\u00f3n en la condici\u00f3n del bucle no est\u00e1 protegida, por lo que una solicitud cercana a SIZE_MAX se desborda circularmente (wraps): la condici\u00f3n del bucle ya est\u00e1 satisfecha, la asignaci\u00f3n se realiza con el tama\u00f1o peque\u00f1o previo al desbordamiento circular, y la funci\u00f3n devuelve verdadero. Se le informa al llamador que la capacidad solicitada fue reservada cuando no lo fue, por lo que una escritura posterior de la longitud solicitada desborda el b\u00fafer de la pila. El propio ejemplo de la biblioteca, example/lib_buffer_unpack.c, demuestra el patr\u00f3n de reservar-luego-escribir, y su aserci\u00f3n defensiva que compara la capacidad con la solicitud se excluye de la compilaci\u00f3n bajo NDEBUG. Los propios puntos de entrada de decodificaci\u00f3n de msgpack-c no derivan el tama\u00f1o de la reserva de una entrada no confiable, por lo que alcanzar esto requiere una integraci\u00f3n que pasa una longitud influenciada por el atacante a la API de reserva, como un transporte de transmisi\u00f3n con prefijo de longitud."}], "id": "CVE-2026-72854", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "LOCAL", "availabilityImpact": "LOW", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 1.0, "impactScore": 4.2, "source": "disclosure@vulncheck.com", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "LOCAL", "availabilityRequirement": "NOT_DEFINED", "baseScore": 5.8, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-72854", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-20T18:52:52.984726Z", "version": "2.0.3"}}]}, "published": "2026-08-20T19:17:01.040", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/msgpack/msgpack-c"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/example/lib_buffer_unpack.c"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/include/msgpack/unpack.h#L219-L223"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/src/unpack.c#L429-L502"}, {"source": "disclosure@vulncheck.com", "url": "https://github.com/msgpack/msgpack-c/issues/1181"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/msgpack-c-integer-overflow-in-msgpack-unpacker-expand-buffer-causes-a-false-success-undersized-reservation"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/msgpack/msgpack-c/issues/1181"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-190"}, {"lang": "en", "value": "CWE-787"}], "source": "disclosure@vulncheck.com", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "[0,7.0.1]"}}], "enrichment": {"confidence": 94.0, "confidence_source": "matching", "scores": [{"score": 94.0, "source": "matching"}]}, "original": {"product": "msgpack-c", "source": "cna", "vendor": "msgpack"}, "product": "msgpack", "vendor": "msgpack"}], "created": "2026-08-21T01:45:08.039155+00:00", "updated": "2026-08-21T13:00:53.750197+00:00", "vendors": ["msgpack", "msgpack$PRODUCT$msgpack"]}