The vulnerability resides in the Python implementation of MessagePack. When an Unpacker object encounters an error, a subsequent reuse of the same instance can trigger an out‑of‑bounds read that causes a segmentation fault and a crash. This is a memory safety weakness identified by CWE‑416. The result is a denial of service that affects the process executing the Unpacker.

The affected product is msgpack-python. All releases before 1.2.1 are vulnerable. The fix was applied in version 1.2.1 and later releases are not affected.

The CVSS score of 7.5 indicates high severity, while the EPSS score is not available and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an environment where untrusted data is unpacked, and the attacker must trigger an error in the Unpacker and then reuse the same instance. A successful exploitation results in a process crash that can be leveraged for a denial‑of‑service attack against the affected application.