CVE-2026-88351: Integer Overflow
An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count, the page allocation size calculation in mpacktreeparsechildren() can overflow sizet and produce an undersized allocation. Subsequent parsing writes mpacknodedatat records beyond the allocated heap buffer, resulting in heap-buffer-overflow, memory corruption, and denial of service.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
The issue affects MPack 1.1.1 running on 32-bit platforms. The provided information does not indicate that 64-bit platforms are affected.
What does an attacker need to trigger the vulnerability?
An attacker needs to cause the application to parse a specially crafted MessagePack array32 or map32 object with an excessively large element count through the MPack Node API.
What is the likely impact of successful exploitation?
Successful parsing can cause a heap-buffer overflow due to an undersized allocation. The stated impacts are memory corruption and denial of service.