CVE-2026-48109— MessagePack-CSharp 输入验证错误漏洞

MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes Lz4Block and Lz4BlockArray. The decoder implementation is based on a deprecated fast-decompression algorithm that does not take a source-length bound. A remote attacker can send a crafted MessagePack payload with manipulated LZ4 token/length fields to force out-of-bounds reads from the compressed input buffer. In affected environments, this can trigger an AccessViolationException during decompression, causing process termination (denial of service). Under some conditions, limited unintended memory disclosure from over-read data may also be possible before failure. This vulnerability is fixed in 2.5.301 and 3.1.7.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

输入验证不恰当

MessagePack-CSharp 输入验证错误漏洞

MessagePack-CSharp MessagePack-CSharp是MessagePack-CSharp团队的一款消息序列化工具。 MessagePack-CSharp 2.5.301之前版本和3.1.7之前版本存在输入验证错误漏洞，该漏洞源于LZ4解压缩路径中使用的解码器实现基于不检查源长度限制的已弃用快速解压缩算法，可能导致远程攻击者发送特制MessagePack有效载荷，操纵LZ4令牌/长度字段强制从压缩输入缓冲区越界读取，从而触发AccessViolationException导致进程终止

N/A

N/A