The msgpack decoder in shamaton/msgpack fails to validate the input buffer length when processing truncated fixext data (format codes 0xd4‑0xd8). This oversight causes an out‑of‑bounds read that triggers a runtime panic, resulting in a denial of service. The vulnerability, identified as a buffer overread (CWE‑805), allows an attacker to disrupt services by supplying malformed MsgPack payloads.

Affected products include shamaton/msgpack v2, shamaton/msgpack v3, and the core shamaton/msgpack repository. No specific version numbers are enumerated in the CNA data, so all releases that contain the vulnerable decoder must be considered potentially impacted until a fix is released.

The CVSS score of 7.5 indicates high severity, while the EPSS value of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Attackers would need to supply crafted MsgPack data to the vulnerable decoder, which is likely achievable via public network interfaces or third‑party integrations. Once triggered, the panic causes the process to terminate, leading to a denial of service for affected systems.