msgpack‑java suffers an integer overflow in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. The overflow occurs when the count is doubled, causing the parser cursor to become desynchronized. As a result, attacker‑controlled data can be returned in place of legitimate fields, leading to data corruption or unintended data exposure.

The vulnerability affects all versions of MessagePack for Java up to and including 0.9.12, identified under the msgpack:msgpack-java vendor identifier. Any application that deserializes data using this library without a newer fixed release is impacted.

The CVSS score of 6.9 indicates moderate severity, and the EPSS score is less than 1%. This vulnerability is not listed in the CISA KEV catalog. The likely attack vector is remote: an attacker can supply a crafted MAP32 container over a network or any other input channel that the application unpacks. If exploited, the attacker can cause deserialized objects to contain malicious or malformed data, potentially leading to further logical or security errors in the consuming application.