MessagePack-CSharp’s ReadDateTime method allocates stack memory using an attacker‑controlled extension length before validating that length against acceptable timestamp sizes. A crafted payload can therefore force a stackalloc that exceeds the call stack, triggering a StackOverflowException that crashes the host process. The result is a denial of service with potential CPU exhaustion if the stack is repeatedly over‑allocated by a very small payload. The flaw is a classic unbounded stack allocation and unchecked extension handling, identified as multiple CWEs including unbounded bounds checks and integer overflows.

The vulnerability affects the MessagePack-CSharp library for .NET prior to version 2.5.301 and before version 3.1.7. Any application that deserializes MessagePack data using ReadDateTime on those releases is at risk.

The CVSS score is 8.2, indicating high severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is sending a malicious MessagePack payload to an application that trusts or accepts untrusted serialized data. If the library is used in a network-facing service, remote exploitation is feasible; local exploitation also works if an attacker can supply data to the deserializer. The conditions are minimal, requiring only that ReadDateTime be invoked on crafted data, with no privilege escalation needed.