An integer overflow exists in MPack 1.1.1 within the mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc() functions. The flaw can cause the allocation size calculation to exceed the actual amount of memory allocated, leading to heap corruption and undefined behavior. The description does not state that the overflow leads to arbitrary code execution or denial of service, but corruption could result in crashes, data integrity issues, or other unpredictable effects.

Only the MPack 1.1.1 library is affected; no other versions or vendors are listed.

The CVSS score of 6.2 indicates moderate severity, while the EPSS score is less than 1%, suggesting a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. The likely attack vector is the delivery of maliciously crafted packed data to a process that parses it with the vulnerable library, as inferred from the nature of the functions involved.