CVE-2026-32284High· 7.5▾ MidnightPoC availableThe msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.
▾ Midnight zone — Critical, or high with PoC / in-the-wild
impact 41.3 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Oct 7.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.7%
0.7% → 0.7%
The msgpack decoder fails to properly validate the input buffer length when processing truncated fixext data (format codes 0xd4-0xd8). This can lead to an out-of-bounds read and a runtime panic, allowing a denial of service attack.
msgpack <= 3.1.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
github.com/shamaton/msgpack/v2 <= 2.4.0github.com/shamaton/msgpack/v3 <= 3.1.0Patched in:
github.com/shamaton/msgpack/v2 2.4.1github.com/shamaton/msgpack/v3 3.1.1Connected by shared product, vendor, weakness, or advisory.
CVE-2026-114613High· 7.5MessagePack: Unbounded memory leak in msgpack C extension on strict_map_key validation failure
CVE-2026-54522LowMessagePack::Buffer#clear Use-After-Free that Enables Cross-Buffer Disclosure
GHSA-6v7p-g79w-8964High· 7.5MessagePack for Python: Out-of-bounds read / crash on Unpacker reuse after a caught error
CVE-2024-58397Medium· 6.1MP4v2 through 2.1.3 Heap Out-of-Bounds Read via MP4File::GetChapters
CVE-2024-5535Critical· 9.1Issue summary: Calling the OpenSSL API function SSL_select_next_proto with an empty supported client protocols buffer may cause a crash or memory contents to be sent to the peer. Impact summary: A buffer overread can have a range of pot…
CVE-2023-37453Medium· 4.6An issue was discovered in the USB subsystem in the Linux kernel through 6.4.2