01 Record

CVE-2026-72854

msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation

MediumPUBLISHEDCNA: VulnCheck

Base score5.8 CVSS v4.0CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

02 Description

msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation

Published

2026-08-20 18:19Z1 DAY AGO

Last updated

2026-08-20 18:53Z1 DAY AGO

Reserved

2026-08-10

Assigning CNA

VulnCheck

Record state

PUBLISHED

Severity

Medium (CVSS 5.8)

CVSS vector

CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Weaknesses

SSVC decision

ExploitationpocAutomatablenoTechnical Impactpartial

Data version

5.2

Document digest

e7873cf80933d1823f01812b573fe28be3a1d645ff8d98fbc38b739a76026420

VendorProductVersionsPlatforms

msgpackmsgpack-c0 to 7.0.1—

github.comGitHub Issue #1181https://github.com/msgpack/msgpack-c/issues/1181issue-tracking
github.commsgpack_unpacker_expand_buffer at c-7.0.1https://github.com/msgpack/msgpack-c/blob/c-7.0.1/src/unpack.c#L429-L502technical-description
github.commsgpack_unpacker_reserve_buffer capacity contract at c-7.0.1https://github.com/msgpack/msgpack-c/blob/c-7.0.1/include/msgpack/unpack.h#L219-L223technical-description
github.comShipped example demonstrating the reserve-then-write patternhttps://github.com/msgpack/msgpack-c/blob/c-7.0.1/example/lib_buffer_unpack.ctechnical-description
github.comhttps://github.com/msgpack/msgpack-cproduct
www.vulncheck.comVulnCheck Advisory: msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservationhttps://www.vulncheck.com/advisories/msgpack-c-integer-overflow-in-msgpack-unpacker-expand-buffer-causes-a-false-success-undersized-reservationthird-party-advisory