MessagePack‑CSharp allows typeless deserialization to bypass type restrictions when dangerous types are nested inside arrays or generic arguments. The library checks only the outermost type name; it does not recurse into element types, so a blocked type can be wrapped and passed the safety check. Once the formatter machinery materializes formatters for the inner type, an attacker can produce arbitrary objects that may execute code or perform unsafe operations during construction or property assignment, which aligns with CWE‑470 and CWE‑502.

The vulnerable product is MessagePack‑CSharp. Versions older than 2.5.301 and older than 3.1.7 are affected. Any .NET Framework or .NET Core application that references these earlier releases is at risk until the library is updated.

The CVSS score of 6.3 reflects moderate severity. No EPSS score is available, so the current exploitation probability cannot be quantified, and the vulnerability is not yet listed in the CISA KEV catalog. Attackers would need to provide malicious serialized data to an untrusted typeless deserialization call, which could be delivered through network traffic or user‑supplied configuration files. When the nested, prohibited type bypasses the outer check, object instantiation can occur, potentially leading to code execution or denial‑of‑service.