{"id":"CVE-2026-88350","title":"An integer overflow vulnerability exists in MPack 1.1.1 in mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc().","summary":"An integer overflow vulnerability exists in MPack 1.1.1 in mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc().","severity":"medium","cvss":6.2,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-190"],"published":"2026-09-22","updated":"2026-10-01","sourceUpdated":"2026-10-01T17:17:32.413","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88350","references":[{"url":"https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b","label":"cve@mitre.org"},{"url":"https://github.com/ludocode/mpack/issues/124","label":"cve@mitre.org"}],"tags":["nvd","cve.org"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-01T16:27:04.290477Z"},"epss":0.0012,"epssPercentile":0.0183,"ingestedAt":"2026-09-22T20:10:15.096Z","slug":"CVE-2026-88350","body":"## Overview\n\nAn integer overflow vulnerability exists in MPack 1.1.1 in mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc().\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":34.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[{"seq":214558,"id":"CVE-2026-88350","ts":1790881060405,"field":"cvss","old":null,"new":"6.2"},{"seq":214557,"id":"CVE-2026-88350","ts":1790881060405,"field":"severity","old":"none","new":"medium"}]}