MessagePack-CSharp MessagePack for C# up to 2.5.300/3.1.6 MessagePackReader.ReadDateTime out-of-bounds

Summaryinfo

A vulnerability was found in MessagePack-CSharp MessagePack for C# up to 2.5.300/3.1.6. It has been rated as problematic. This issue affects the function MessagePackReader.ReadDateTime. The manipulation leads to out-of-bounds. This vulnerability is uniquely identified as CVE-2026-48502. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in MessagePack-CSharp MessagePack for C# up to 2.5.300/3.1.6. This issue affects the function MessagePackReader.ReadDateTime. The manipulation with an unknown input leads to a out-of-bounds vulnerability. Using CWE to declare the problem leads to CWE-125. The product reads data past the end, or before the beginning, of the intended buffer. Impacted is availability. The summary by CVE is:

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, MessagePackReader.ReadDateTime() can allocate stack memory based on an attacker-controlled MessagePack extension length. In the slow path for timestamp extension parsing, the computed tokenSize includes the extension body length from the wire and is used in a stackalloc operation before the extension length is validated as one of the valid timestamp sizes. A very small payload can claim a large timestamp extension body and cause a stack allocation large enough to trigger an uncatchable StackOverflowException, terminating the host process. This vulnerability is fixed in 2.5.301 and 3.1.7.

It is possible to read the advisory at github.com. The identification of this vulnerability is CVE-2026-48502 since 05/21/2026. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details of the vulnerability are known, but there is no available exploit.

Upgrading to version 2.5.301 or 3.1.7 eliminates this vulnerability.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• MessagePack-CSharp

Name

• MessagePack for C#

Version

• 2.0
• 2.1
• 2.2
• 2.3
• 2.4
• 2.5.300
• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion