CVE-2026-72854: msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation

Vulnerability summary

CVE-2026-72854 is a medium (CVSS 5.8) Integer Overflow or Wraparound vulnerability in msgpack msgpack-c. EPSS estimates a 0.16% chance of exploitation in the next 30 days, higher than 4.8% of scored vulnerabilities.

Timeline

1. 20-08-2026
   PublishedVulnerability first disclosed.
2. 24-09-2026
   Last modifiedVulnerability information updated.

Description

msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the addition in the loop condition is unguarded, so a request near SIZE_MAX wraps: the loop condition is already satisfied, the allocation is performed at the small pre-wrap size, and the function returns true. The caller is told the requested capacity was reserved when it was not, so a subsequent write of the requested length overflows the heap buffer. The library's own example/lib_buffer_unpack.c demonstrates the reserve-then-write pattern, and its defensive assert comparing capacity against the request is compiled out under NDEBUG. msgpack-c's own decode entry points do not derive the reservation size from untrusted input, so reaching this requires an integration that passes an attacker-influenced length to the reservation API, such as a length-prefixed streaming transport.

• CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.
• CWE-787Out-of-bounds WriteThe product writes data past the end, or before the beginning, of the intended buffer.