The reported vulnerability lies in the LZ4 decompression path of the MessagePack-CSharp library. A small compressed payload with a large claimed uncompressed length can force an allocator to reserve a huge buffer before the data is validated, causing a memory exhaustion that crashes or slows the running process. This buffer allocation based on untrusted data corresponds to CWE‑409 and CWE‑770.

The issue affects the MessagePack-CSharp library, versions prior to 2.5.301 in the 2.x line and prior to 3.1.7 in the 3.x line. Any application that deserializes LZ4‑compressed MessagePack data using these library versions is vulnerable.

The CVSS score of 6.3 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. No EPSS score is available, so the exploitation probability is unknown, but the flaw can be triggered with any LZ4 payload, making an attack straightforward. The likely vector is network or file‑based, targeting any system that accepts LZ4 input from an external source. The attacker requires no elevated privileges; the application using the library is the only necessary context.