The msgpack decoder in shamaton/msgpack fails to validate the input buffer length when processing truncated fixext data (format codes 0xd4‑0xd8). This leads to an out‑of‑bounds read (CWE‑125) that triggers a runtime panic, resulting in a denial of service. The vulnerability also represents a buffer overread (CWE‑805), allowing an attacker to disrupt services by supplying malformed MsgPack payloads.

Affected products include shamaton/msgpack v2, shamaton/msgpack v3, and the core shamaton/msgpack repository. No specific version numbers are enumerated in the CNA data, so all releases that contain the vulnerable decoder must be considered potentially impacted until a fix is released.

The CVSS score of 7.5 indicates high severity, while the EPSS value of less than 1% suggests a low probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is supplying crafted MsgPack data to the vulnerable decoder; based on the description, it is inferred that this could be done via public network interfaces or third‑party integrations. Once triggered, the panic causes the process to terminate, leading to a denial of service for affected systems.