CVE-2026-48514— MessagePack-CSharp 资源管理错误漏洞

MessagePack-CSharp: Unity unsafe blit formatter allocates from unbounded byte length

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, UnsafeBlitFormatterBase<T>.Deserialize reads an attacker-controlled byteLength from an extension payload and allocates an array based on that value before validating it against the extension header length or remaining payload bytes. The outer extension header is bounded by available input, but that bound is not used to constrain the inner byteLength before allocation. A very small payload can therefore request a very large T[] allocation. This vulnerability is fixed in 2.5.301 and 3.1.7.

N/A

不加限制或调节的资源分配

MessagePack-CSharp 资源管理错误漏洞

MessagePack-CSharp MessagePack-CSharp是MessagePack-CSharp团队的一款消息序列化工具。 MessagePack-CSharp 2.5.301之前版本和3.1.7之前版本存在资源管理错误漏洞，该漏洞源于UnsafeBlitFormatterBase<T>.Deserialize在分配基于扩展有效载荷内攻击者控制的byteLength的数组之前，未根据扩展标头长度或剩余有效载荷字节进行验证，可能导致非常小的有效载荷请求非常大的T[]分配。

N/A

N/A