MessagePack-CSharp’s MessagePackReader.TrySkip method can recursively descend into nested arrays and maps without incrementing the reader depth or invoking the configured depth checks. The bypass of MessagePackSecurity.MaximumObjectGraphDepth allows an attacker to send deeply nested data that forces the parser into unbounded recursion, which inevitably results in a StackOverflowException that crashes the process. This vulnerability does not provide direct code execution but causes denial of service by terminating the application.

The bug affects MessagePack-CSharp library versions earlier than 2.5.301 and 3.1.7. Applications using these versions to deserialize MessagePack payloads—particularly those that accept user‑supplied data—are susceptible.

The CVSS score is 7.5, indicating a high severity. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog. The exploitation requires the ability to supply crafted MessagePack data to the vulnerable application, a situation common in services that expose MessagePack endpoints. Once the data is processed, the application will crash without any mitigation from the library itself. The most likely attack vector is through inbound network or API calls that include MessagePack content.