An integer overflow (CWE‑190) exists in the MPack Node API of version 1.1.1 when parsing specially crafted MessagePack array32 or map32 objects on 32‑bit platforms. The overflow occurs during the calculation of the allocation size in mpack_tree_parse_children(), causing an undersized heap allocation. Subsequent parsing writes mpack_node_data_t records beyond the allocated buffer, resulting in a heap‑buffer overflow that corrupts memory and can lead to a denial of service.

The affected software is the MPack library, specifically version 1.1.1. The vulnerability is limited to 32‑bit operating systems where the size_t type is 32 bits. No vendor or product name is provided beyond the generic MPack library.

The CVSS score is 9.8, and the EPSS score is less than 1%; the CVE is not listed in KEV. The likely attack vector is a malicious MessagePack payload supplied from a remote or untrusted source, inferred because the parser handles external input. By providing an array32 or map32 with an excessively large element count, an attacker can trigger the integer overflow, causing a heap‑buffer overflow that corrupts memory, potentially crashing the application and denying service.