MessagePack for Ruby implements a binary serialization format. In versions prior to 1.8.2, the Buffer#clear method in ext/msgpack/buffer.c fails to reset the rmem_last, rmem_end, and rmem_owner pointers after a memory page from the shared pool is reclaimed. This stale metadata allows a subsequent Buffer#write to an alias of that memory page, and a second Buffer instance that shares the same allocated chunk can then access or corrupt data that was stored by the first instance. The flaw is a use‑after‑free that enables a cross‑buffer disclosure or corruption attack, potentially exposing sensitive application data or corrupting normal program state. The low CVSS score of 2.1 reflects the limited impact level, but the presence of a data disclosure vector remains noteworthy for systems that handle confidential information.

The affected product is MessagePack for Ruby (msgpack:msgpack-ruby). Any Ruby environment that includes this gem in a version prior to 1.8.2 is susceptible. The vulnerability is addressed starting with gem version 1.8.2. There are no explicit OS or platform constraints beyond the presence of the vulnerable Ruby library.

The CVSS base score of 2.1 indicates low severity, and the EPSS score of 0.00119 (less than 1%) indicates a very low exploitation probability. The flaw is not listed in the CISA KEV catalog. An attacker with the ability to construct or control both Buffer objects – which could be achieved by executing Ruby code from an untrusted input source – can exploit the use‑after‑free to read or overwrite memory belonging to another buffer. The exploit does not require elevated privileges or network access if one can supply Ruby code; it may be possible to leverage the flaw in a remote code execution context if the application exposes a user‑supplied Ruby API. Overall the risk is low to moderate, depending on the exposure of Ruby code to untrusted input.