What’s Vulnerable › Vulnerabilities
CVE-2026-48514: MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length
- Severity: high (CVSS 7.5 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-06-22 · updated 2026-06-25
- Weakness: CWE-770
Description
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, UnsafeBlitFormatterBase<T>.Deserialize reads an attacker-controlled byteLength from an extension payload and allocates an array based on that value before validating it against the extension header length or remaining payload bytes. The outer extension header is bounded by available input, but that bound is not used to constrain the inner byteLength before allocation. A very small payload can therefore request a very large T[] allocation. This vulnerability is fixed in 2.5.301 and 3.1.7.
Affected products
- MessagePack-CSharp: before 2.5.301; from 3.0.3 before 3.1.7 — fixed in 2.5.301, 3.1.7
How to fix
Upgrade to a fixed version: MessagePack-CSharp 2.5.301, 3.1.7. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-48514 or the next vulnerability affects your stack