An unchecked stack allocation occurs during DateTime decoding in Nerdbank.MessagePack versions prior to 1.1.62. A malicious payload that declares an oversized timestamp extension length forces the library to allocate an attacker‑controlled number of bytes on the stack, resulting in a StackOverflowException that cannot be caught by application code. The exception terminates the process, creating a denial‑of‑service condition. The flaw is a classic uncontrolled memory allocation problem, aligned with CWE‑789.

Users of the Nerdbank.MessagePack library provided by AArnott are affected if they use any version earlier than 1.1.62. The security advisory applies to all platforms that support the library and any application that deserializes untrusted MessagePack data using these vulnerable versions.

With a CVSS score of 7.5, the vulnerability is rated high severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog, suggesting no known large‑scale exploitation yet. Based on the description, it is inferred that an attacker can supply an oversized timestamp extension via external inputs if the application accepts untrusted MessagePack data from a network, file, or other source, forcing the library to allocate an attacker‑controlled number of bytes on the stack. Successful exploitation leads to a process crash and potential loss of availability for services dependent on that process.