CVE-2026-107302

Summary

The msgpack5 library has a buffer over-read vulnerability where it reads a map32 header's length before validating the complete header is available, leading to unexpected RangeError exceptions instead of proper IncompleteBufferError handling. This can cause application crashes or unexpected termination when processing malformed data.

Exploitability

Exploitation requires sending a specially crafted truncated map32 header that triggers an out-of-bounds read, which may be moderately difficult to exploit directly but can reliably cause denial of service through unexpected application termination.

Blast radius

The vulnerability affects applications using msgpack5 for data processing, potentially causing widespread service disruption when malformed data is received through network streams or file processing.

Detection

No reliable host or network indicator is derivable from the published description.

Prioritized remediation

Upgrade to version 6.1.0 or later to fix the out-of-bounds buffer read issue in msgpack5.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.