Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.8
CVE-2026-88351: MPack 1.1.1 could crash on crafted data
CVE-2026-88351 · published 18 days ago
Summary
The MPack library version 1.1.1 on 32‑bit systems can mishandle specially crafted MessagePack messages, leading to memory corruption and possible service shutdown. This risk occurs when the software processes unusually large array or map objects. Upgrade to a newer MPack release or apply the vendor’s patch to eliminate the problem.
What to do
The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:16.04:LTS | canonical | mpack | All versions |
Original advisory text
An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large ele...
An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count, the page allocation size calculation in mpack_tree_parse_children() can overflow size_t and produce an undersized allocation. Subsequent parsing writes mpack_node_data_t records beyond the allocated heap buffer, resulting in heap-buffer-overflow, memory corruption, and denial of service.
References
- https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9...
- https://github.com/ludocode/mpack/issues/123
- https://ubuntu.com/security/CVE-2026-88351 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-88351 Third Party Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88351... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-88351 Vendor Advisory
Internet-facing
3 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker full control
Severity
9.8
Critical
Type
CWE-190Integer Overflow
Timeline
Published24 Sep 2026
Updated12 Oct 2026
First seen24 Sep 2026
Sources
CVE-2026-88351 · NVD
CVE-2026-88351 · MITRE
UBUNTU-CVE-2026-88351 · OSV
CVE-2026-88351 · OSV
Track software like this
Free during beta