{"vulnerability": "ghsa-4mrv-5p47-p938", "sightings": [{"uuid": "012bc093-5cc4-488d-8293-3189fbb6a178", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-4mrv-5p47-p938", "type": "seen", "source": "https://gist.github.com/alon710/f9483ca84f65ab9c98c78744c876def1", "content": "# CVE-2026-54522: CVE-2026-54522: Same-Process Use-After-Free and Cross-Buffer Data Disclosure in msgpack-ruby\n\n> **CVSS Score:** 2.1\n> **Published:** 2026-07-30\n> **Full Report:** https://cvereports.com/reports/CVE-2026-54522\n\n## Summary\nA Use-After-Free (UAF) vulnerability exists in msgpack-ruby prior to version 1.8.2. The MessagePack::Buffer#clear method returns the associated 4 KiB rmem page to the shared pool but fails to reset the buffer's tracking pointers (rmem_last, rmem_end, and rmem_owner). Subsequent write operations on the cleared buffer can alias the freed page, allowing concurrent buffers to access, disclose, or corrupt cross-buffer data. This issue is resolved in version 1.8.2.\n\n## TL;DR\nA Use-After-Free in msgpack-ruby < 1.8.2 allows cross-buffer memory aliasing, resulting in same-process information disclosure and stream corruption when buffers are cleared and reused.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-416 (Use After Free)\n- **Attack Vector**: Local (AV:L)\n- **CVSS v4.0 Score**: 2.1 (Low)\n- **Exploit Status**: Proof-of-Concept Available\n- **Impact**: Information Disclosure / Stream Corruption\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- Ruby applications utilizing the msgpack-ruby gem with persistent or pooled MessagePack::Buffer instances.\n- **msgpack-ruby**: < 1.8.2 (Fixed in: `1.8.2`)\n\n## Mitigation\n\n- Upgrade the msgpack dependency to version 1.8.2 or later.\n- Refactor applications to instantiate a new MessagePack::Buffer for every serialization task instead of reusing and clearing a persistent buffer.\n- Conduct static analysis scanning of dependency trees to identify and flag older versions of the msgpack gem.\n\n**Remediation Steps:**\n1. Open the application's Gemfile and locate the msgpack dependency declaration.\n2. Update the entry to require version 1.8.2 or higher: gem 'msgpack', '>= 1.8.2'\n3. Execute the package manager command to update the dependency: bundle update msgpack\n4. Deploy the updated dependency configuration to testing and production environments.\n\n## References\n\n- [GitHub Security Advisory GHSA-4mrv-5p47-p938](https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-4mrv-5p47-p938)\n- [Fix Commit 5627d71606b565641d2dd501b82aae862f4abe90](https://github.com/msgpack/msgpack-ruby/commit/5627d71606b565641d2dd501b82aae862f4abe90)\n- [Ruby Advisory Database Entry](https://github.com/rubysec/ruby-advisory-db/blob/master/gems/msgpack/CVE-2026-54522.yml)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-54522) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-07-30T17:31:24.278397Z"}]}