MessagePack-CSharp’s UnsafeBlitFormatterBase<T>.Deserialize method can allocate an array of arbitrary length based on an attacker‑controlled byteLength value found in an extension payload. The allocation occurs before range validation, allowing a small payload to trigger a much larger in‑memory allocation. This can exhaust process memory or lead to a denial of service, compromising confidentiality indirectly by affecting system availability.

The vulnerability affects the MessagePack-CSharp library in all releases prior to 2.5.301 and 3.1.7. Users of these older library versions that deserialize extension payloads with the UnsafeBlitFormatterBase<T> formatter are impacted.

With a CVSS score of 6.3 the vulnerability is moderate. EPSS data is not available, and it is not listed in CISA’s KEV catalog, indicating no known exploits yet. Attackers could exploit the flaw by delivering a crafted payload to any application that uses the unsafe blit formatter for untrusted data, triggering a large allocation and potentially exhausting memory.