The msgpack_unpacker_expand_buffer function performs an unchecked size_t addition when computing a new buffer size. When an attacker requests a size close to SIZE_MAX, the addition overflows, the loop condition is satisfied before the allocation, and the function falsely reports success. The caller is then led to write the requested amount into a buffer that is too small, causing a heap overflow. This pattern is a classic integer overflow (CWE‑190) that results in a buffer overflow (CWE‑787), allowing an attacker to corrupt memory and potentially execute arbitrary code.

The vulnerability applies to the msgpack:msgpack‑c library, with the referenced affected version being c‑7.0.1. Any application that uses msgpack_unpacker_reserve_buffer with input‑derived lengths—such as a length‑prefixed streaming protocol—faces risk.

The CVSS score of 5.8 indicates a moderate severity. EPSS is not available and the vulnerability is not listed in KEV. The likely attack vector is remote, via network traffic that an application parses with this API, enabling an attacker to trigger the overflow without local interaction. If exploited, the heap corruption could lead to crashes or provide a foothold for further exploitation.