msgpack-java suffers an integer overflow in MessageUnpacker.skipValue() when it processes MAP32 containers whose element count is at or above 0x40000000. The overflow occurs when the count is doubled, causing the parser cursor to become desynchronized. As a result, attacker‑controlled data can be returned in place of legitimate fields, leading to data corruption or unintended data exposure.

The vulnerability affects all versions of MessagePack for Java up to and including 0.9.12, sold under the msgpack:msgpack-java vendor identifier. Any application that deserializes data using this library without a newer fixed release is impacted.

The CVSS score of 6.9 indicates moderate severity, and no EPSS score is currently available. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker can supply a crafted MAP32 container over a network or any other input channel that the application unpacks. If exploited, the attacker can cause deserialized objects to contain malicious or malformed data, potentially leading to further logical or security errors in the consuming application.