CVE-2026-48109

MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

Published Jun 22, 2026 CVSS 3.1 · 8.2 High EPSS < 1% KEV · Not listed

Description

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes Lz4Block and Lz4BlockArray. The decoder implementation is based on a deprecated fast-decompression algorithm that does not take a source-length bound. A remote attacker can send a crafted MessagePack payload with manipulated LZ4 token/length fields to force out-of-bounds reads from the compressed input buffer. In affected environments, this can trigger an AccessViolationException during decompression, causing process termination (denial of service). Under some conditions, limited unintended memory disclosure from over-read data may also be possible before failure. This vulnerability is fixed in 2.5.301 and 3.1.7.

Analysis

Technical impact

A malformed MessagePack payload can cause out‑of‑bounds reads in the LZ4 decompression path of MessagePack-CSharp. The vulnerable implementation ignores the source‑length bound, allowing a remote attacker to craft token/length fields that trigger an AccessViolationException, which terminates the process. Under certain circumstances a brief unintended memory disclosure is also possible before failure.

Affected Systems

The vulnerability exists in MessagePack-CSharp versions prior to 2.5.301 and 3.1.7. Applications that reference the MessagePack serializer for C# and enable Lz4Block or Lz4BlockArray compression modes are susceptible.

Risk and Exploitability

With a CVSS score of 8.2 the vulnerability is considered high severity. The EPSS score is not available and it is not listed in the CISA KEV catalog. A remote attacker can inject a crafted MessagePack payload over any network channel that the application accepts. Because the attack relies on deserialization of untrusted data, the attack vector is network‑based. Successful exploitation results in process termination and possible limited memory disclosure, making it a valuable tool for denial of service attacks against services using the affected library.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

MessagePack-CSharp

affected

Version	Status	Constraints
`>= 3.1.7, < 3.1.7`	affected	—
`< 2.5.301`	affected	—

Configuration 1 [-]

OR	cpe:2.3:a:messagepack:messagepack::::::c\#::*
	cpe:2.3:a:messagepack:messagepack::::::c\#::*

No data.

Vendor Product Versions

Messagepack

Messagepack-csharp

Version	Status	Scheme	Platform
`[3.1.7,3.1.7)`	affected	semver	—
`[0,2.5.301)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Update MessagePack-CSharp to version 2.5.301 or 3.1.7, or later, via your package manager or re‑building your project
Configure your application to disable or remove Lz4Block and Lz4BlockArray compression modes if they are not required
Validate incoming MessagePack data and enforce strict length checks before invoking the decompression routine to mitigate the risk of malformed payloads

Generated by OpenCVE AI on June 22, 2026 at 23:25 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-hv8m-jj95-wg3x	MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.509% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-hv8m-jj95-wg3x

History

Jun 24, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Messagepack Messagepack messagepack-csharp
Vendors & Products		Messagepack Messagepack messagepack-csharp

Jun 23, 2026 1:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 22, 2026 10:00 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, A vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes Lz4Block and Lz4BlockArray. The decoder implementation is based on a deprecated fast-decompression algorithm that does not take a source-length bound. A remote attacker can send a crafted MessagePack payload with manipulated LZ4 token/length fields to force out-of-bounds reads from the compressed input buffer. In affected environments, this can trigger an AccessViolationException during decompression, causing process termination (denial of service). Under some conditions, limited unintended memory disclosure from over-read data may also be possible before failure. This vulnerability is fixed in 2.5.301 and 3.1.7.
Title		MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input
Weaknesses		CWE-20
References		https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-hv8m-jj95-wg3x
Metrics		cvssV3_1 `{'score': 8.2, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H'}`