Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2026-48109: MessagePack C# LZ4 decompression can crash process

CVE-2026-48109 · published 4 months ago

Summary

The MessagePack library for C# versions before 2.5.301 and 3.1.7 may mishandle specially crafted compressed data and read beyond the end of the input buffer. This can cause the application to stop unexpectedly, and in some cases expose a small amount of memory. Update the library to version 2.5.301 or later (or 3.1.7 or later) to fix the issue.

What to do

Update neuecc messagepack to version 2.5.301.
Update neuecc messagepack to version 3.1.7.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	messagepack	messagepack	< 2.5.301 >= 3.0.3, < 3.1.7 `cpe:2.3:a:messagepack:messagepack::::::c\#::*`
nuget	neuecc	messagepack	< 2.5.301 >= 3.0.214-rc.1, < 3.1.7 Fix: upgrade to 2.5.301

Original advisory text

MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes Lz4Block and Lz4BlockArray. The decoder implementation is based on a deprecated fast-decompression algorithm that does not take a source-length bound. A remote attacker can send a crafted MessagePack payload with manipulated LZ4 token/length fields to force out-of-bounds reads from the compressed input buffer. In affected environments, this can trigger an AccessViolationException during decompression, causing process termination (denial of service). Under some conditions, limited unintended memory disclosure from over-read data may also be possible before failure. This vulnerability is fixed in 2.5.301 and 3.1.7.

References

https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHS... Vendor Advisory
https://github.com/advisories/GHSA-hv8m-jj95-wg3x
https://github.com/MessagePack-CSharp/MessagePack-CSharp Product
https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48109... Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2026-48109 Vendor Advisory

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically
Gives an attacker partial control

Severity

8.2 High

Exploitation

<1% chance of attack within 30 days

Type

CWE-20Improper Input Validation

Timeline

Published22 Jun 2026

Updated4 Nov 2026

First seen11 Jun 2026

Sources

GHSA-hv8m-jj95-wg3x · GHSA

CVE-2026-48109 · NVD

GHSA-hv8m-jj95-wg3x · OSV

CVE-2026-48109 · OSV

Track software like this

Free during beta