Vulnerability-Lookup

CVE-2026-72854 (GCVE-0-2026-72854)

Vulnerability from cvelistv5 – Published: 2026-08-20 18:19 – Updated: 2026-08-20 18:53

Title

msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation

Summary

msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the addition in the loop condition is unguarded, so a request near SIZE_MAX wraps: the loop condition is already satisfied, the allocation is performed at the small pre-wrap size, and the function returns true. The caller is told the requested capacity was reserved when it was not, so a subsequent write of the requested length overflows the heap buffer. The library's own example/lib_buffer_unpack.c demonstrates the reserve-then-write pattern, and its defensive assert comparing capacity against the request is compiled out under NDEBUG. msgpack-c's own decode entry points do not derive the reservation size from untrusted input, so reaching this requires an integration that passes an attacker-influenced length to the reservation API, such as a length-prefixed streaming transport.

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L

5.8 (Medium)


                        
                          CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

SSVC

Exploitation: poc Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-20 18:52 UTC

CWE

CWE-190 - Integer Overflow or Wraparound
CWE-787 - Out-of-bounds Write

Assigner

VulnCheck mitre root

References

6 references

URL	Tags
https://github.com/msgpack/msgpack-c/issues/1181	issue-tracking
https://github.com/msgpack/msgpack-c/blob/c-7.0.1…	technical-description
https://github.com/msgpack/msgpack-c/blob/c-7.0.1…	technical-description
https://github.com/msgpack/msgpack-c/blob/c-7.0.1…	technical-description
https://github.com/msgpack/msgpack-c	product
https://www.vulncheck.com/advisories/msgpack-c-in…	third-party-advisory

Impacted products

1 product

Vendor	Product	Version	CPE status
msgpack	msgpack-c	Affected: 0 , ≤ 7.0.1 (custom)	guessed

Date Public

2026-08-13 00:00

Credits

mtholmquist

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-72854",
                "options": [
                  {
                    "Exploitation": "poc"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-20T18:52:52.984726Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-20T18:53:26.891Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "exploit"
            ],
            "url": "https://github.com/msgpack/msgpack-c/issues/1181"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "msgpack-c",
          "repo": "https://github.com/msgpack/msgpack-c",
          "vendor": "msgpack",
          "versions": [
            {
              "lessThanOrEqual": "7.0.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "mtholmquist"
        }
      ],
      "datePublic": "2026-08-13T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the addition in the loop condition is unguarded, so a request near SIZE_MAX wraps: the loop condition is already satisfied, the allocation is performed at the small pre-wrap size, and the function returns true. The caller is told the requested capacity was reserved when it was not, so a subsequent write of the requested length overflows the heap buffer. The library\u0027s own example/lib_buffer_unpack.c demonstrates the reserve-then-write pattern, and its defensive assert comparing capacity against the request is compiled out under NDEBUG. msgpack-c\u0027s own decode entry points do not derive the reservation size from untrusted input, so reaching this requires an integration that passes an attacker-influenced length to the reservation API, such as a length-prefixed streaming transport."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        },
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "LOCAL",
            "baseScore": 5.8,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "LOW",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "HIGH"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-190",
              "description": "Integer Overflow or Wraparound",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-787",
              "description": "Out-of-bounds Write",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-20T18:19:24.266Z",
        "orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
        "shortName": "VulnCheck"
      },
      "references": [
        {
          "name": "GitHub Issue #1181",
          "tags": [
            "issue-tracking"
          ],
          "url": "https://github.com/msgpack/msgpack-c/issues/1181"
        },
        {
          "name": "msgpack_unpacker_expand_buffer at c-7.0.1",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/src/unpack.c#L429-L502"
        },
        {
          "name": "msgpack_unpacker_reserve_buffer capacity contract at c-7.0.1",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/include/msgpack/unpack.h#L219-L223"
        },
        {
          "name": "Shipped example demonstrating the reserve-then-write pattern",
          "tags": [
            "technical-description"
          ],
          "url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/example/lib_buffer_unpack.c"
        },
        {
          "tags": [
            "product"
          ],
          "url": "https://github.com/msgpack/msgpack-c"
        },
        {
          "name": "VulnCheck Advisory: msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation",
          "tags": [
            "third-party-advisory"
          ],
          "url": "https://www.vulncheck.com/advisories/msgpack-c-integer-overflow-in-msgpack-unpacker-expand-buffer-causes-a-false-success-undersized-reservation"
        }
      ],
      "title": "msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation",
      "x_generator": {
        "engine": "vulncheck-endgame"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2026-72854",
    "datePublished": "2026-08-20T18:19:24.266Z",
    "dateReserved": "2026-08-10T15:16:31.371Z",
    "dateUpdated": "2026-08-20T18:53:26.891Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-72854",
      "date": "2026-08-29",
      "epss": "0.00113",
      "percentile": "0.01546"
    },
    "microsoft_vex": {
      "current_release_date": "2026-08-25T01:04:54.000Z",
      "cve": "CVE-2026-72854",
      "id": "msrc_CVE-2026-72854",
      "initial_release_date": "2026-08-25T01:04:54.000Z",
      "product_status:known_affected": "3",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-72854.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-72854\",\"sourceIdentifier\":\"disclosure@vulncheck.com\",\"published\":\"2026-08-20T19:17:01.040\",\"lastModified\":\"2026-08-20T19:17:01.040\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the addition in the loop condition is unguarded, so a request near SIZE_MAX wraps: the loop condition is already satisfied, the allocation is performed at the small pre-wrap size, and the function returns true. The caller is told the requested capacity was reserved when it was not, so a subsequent write of the requested length overflows the heap buffer. The library\u0027s own example/lib_buffer_unpack.c demonstrates the reserve-then-write pattern, and its defensive assert comparing capacity against the request is compiled out under NDEBUG. msgpack-c\u0027s own decode entry points do not derive the reservation size from untrusted input, so reaching this requires an integration that passes an attacker-influenced length to the reservation API, such as a length-prefixed streaming transport.\"}],\"affected\":[{\"source\":\"disclosure@vulncheck.com\",\"affectedData\":[{\"vendor\":\"msgpack\",\"product\":\"msgpack-c\",\"defaultStatus\":\"unaffected\",\"repo\":\"https://github.com/msgpack/msgpack-c\",\"versions\":[{\"version\":\"0\",\"lessThanOrEqual\":\"7.0.1\",\"versionType\":\"custom\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":5.8,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"PASSIVE\",\"vulnConfidentialityImpact\":\"NONE\",\"vulnIntegrityImpact\":\"HIGH\",\"vulnAvailabilityImpact\":\"LOW\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"cvssMetricV31\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L\",\"baseScore\":5.3,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":1.0,\"impactScore\":4.2}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-08-20T18:52:52.984726Z\",\"id\":\"CVE-2026-72854\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"disclosure@vulncheck.com\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-190\"},{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"references\":[{\"url\":\"https://github.com/msgpack/msgpack-c\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://github.com/msgpack/msgpack-c/blob/c-7.0.1/example/lib_buffer_unpack.c\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://github.com/msgpack/msgpack-c/blob/c-7.0.1/include/msgpack/unpack.h#L219-L223\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://github.com/msgpack/msgpack-c/blob/c-7.0.1/src/unpack.c#L429-L502\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://github.com/msgpack/msgpack-c/issues/1181\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://www.vulncheck.com/advisories/msgpack-c-integer-overflow-in-msgpack-unpacker-expand-buffer-causes-a-false-success-undersized-reservation\",\"source\":\"disclosure@vulncheck.com\"},{\"url\":\"https://github.com/msgpack/msgpack-c/issues/1181\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\"}]}}",
    "redhat_vex": {
      "current_release_date": "2026-08-24T11:53:47+00:00",
      "cve": "CVE-2026-72854",
      "id": "CVE-2026-72854",
      "initial_release_date": "2026-08-20T18:19:24.266000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "msgpack-c: msgpack-c: Heap buffer overflow via integer overflow in buffer expansion.",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-72854.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-72854\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-08-20T18:52:52.984726Z\"}}}], \"references\": [{\"url\": \"https://github.com/msgpack/msgpack-c/issues/1181\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-08-20T18:53:19.871Z\"}}], \"cna\": {\"title\": \"msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation\", \"credits\": [{\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"mtholmquist\"}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 5.3, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"REQUIRED\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"LOW\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}, {\"format\": \"CVSS\", \"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 5.8, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N\", \"userInteraction\": \"PASSIVE\", \"attackComplexity\": \"HIGH\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"HIGH\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"LOW\", \"subConfidentialityImpact\": \"NONE\", \"vulnConfidentialityImpact\": \"NONE\"}}], \"affected\": [{\"repo\": \"https://github.com/msgpack/msgpack-c\", \"vendor\": \"msgpack\", \"product\": \"msgpack-c\", \"versions\": [{\"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\", \"lessThanOrEqual\": \"7.0.1\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2026-08-13T00:00:00.000Z\", \"references\": [{\"url\": \"https://github.com/msgpack/msgpack-c/issues/1181\", \"name\": \"GitHub Issue #1181\", \"tags\": [\"issue-tracking\"]}, {\"url\": \"https://github.com/msgpack/msgpack-c/blob/c-7.0.1/src/unpack.c#L429-L502\", \"name\": \"msgpack_unpacker_expand_buffer at c-7.0.1\", \"tags\": [\"technical-description\"]}, {\"url\": \"https://github.com/msgpack/msgpack-c/blob/c-7.0.1/include/msgpack/unpack.h#L219-L223\", \"name\": \"msgpack_unpacker_reserve_buffer capacity contract at c-7.0.1\", \"tags\": [\"technical-description\"]}, {\"url\": \"https://github.com/msgpack/msgpack-c/blob/c-7.0.1/example/lib_buffer_unpack.c\", \"name\": \"Shipped example demonstrating the reserve-then-write pattern\", \"tags\": [\"technical-description\"]}, {\"url\": \"https://github.com/msgpack/msgpack-c\", \"tags\": [\"product\"]}, {\"url\": \"https://www.vulncheck.com/advisories/msgpack-c-integer-overflow-in-msgpack-unpacker-expand-buffer-causes-a-false-success-undersized-reservation\", \"name\": \"VulnCheck Advisory: msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation\", \"tags\": [\"third-party-advisory\"]}], \"x_generator\": {\"engine\": \"vulncheck-endgame\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the addition in the loop condition is unguarded, so a request near SIZE_MAX wraps: the loop condition is already satisfied, the allocation is performed at the small pre-wrap size, and the function returns true. The caller is told the requested capacity was reserved when it was not, so a subsequent write of the requested length overflows the heap buffer. The library\u0027s own example/lib_buffer_unpack.c demonstrates the reserve-then-write pattern, and its defensive assert comparing capacity against the request is compiled out under NDEBUG. msgpack-c\u0027s own decode entry points do not derive the reservation size from untrusted input, so reaching this requires an integration that passes an attacker-influenced length to the reservation API, such as a length-prefixed streaming transport.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-190\", \"description\": \"Integer Overflow or Wraparound\"}]}, {\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-787\", \"description\": \"Out-of-bounds Write\"}]}], \"providerMetadata\": {\"orgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"shortName\": \"VulnCheck\", \"dateUpdated\": \"2026-08-20T18:19:24.266Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-72854\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-20T18:53:26.891Z\", \"dateReserved\": \"2026-08-10T15:16:31.371Z\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"datePublished\": \"2026-08-20T18:19:24.266Z\", \"assignerShortName\": \"VulnCheck\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-72854

Vulnerability from fkie_nvd - Published: 2026-08-20 19:17 - Updated: 2026-08-20 19:17

Severity

5.3 (Medium) - CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L

Summary

References

	URL	Tags
	disclosure@vulncheck.com	https://github.com/msgpack/msgpack-c
	disclosure@vulncheck.com	https://github.com/msgpack/msgpack-c/blob/c-7.0.1/example/lib_buffer_unpack.c
	disclosure@vulncheck.com	https://github.com/msgpack/msgpack-c/blob/c-7.0.1/include/msgpack/unpack.h#L219-L223
	disclosure@vulncheck.com	https://github.com/msgpack/msgpack-c/blob/c-7.0.1/src/unpack.c#L429-L502
	disclosure@vulncheck.com	https://github.com/msgpack/msgpack-c/issues/1181
	disclosure@vulncheck.com	https://www.vulncheck.com/advisories/msgpack-c-integer-overflow-in-msgpack-unpacker-expand-buffer-causes-a-false-success-undersized-reservation
	134c704f-9b21-4f2e-91b3-4a467353bcc0	https://github.com/msgpack/msgpack-c/issues/1181

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "msgpack-c",
          "repo": "https://github.com/msgpack/msgpack-c",
          "vendor": "msgpack",
          "versions": [
            {
              "lessThanOrEqual": "7.0.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "source": "disclosure@vulncheck.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the addition in the loop condition is unguarded, so a request near SIZE_MAX wraps: the loop condition is already satisfied, the allocation is performed at the small pre-wrap size, and the function returns true. The caller is told the requested capacity was reserved when it was not, so a subsequent write of the requested length overflows the heap buffer. The library\u0027s own example/lib_buffer_unpack.c demonstrates the reserve-then-write pattern, and its defensive assert comparing capacity against the request is compiled out under NDEBUG. msgpack-c\u0027s own decode entry points do not derive the reservation size from untrusted input, so reaching this requires an integration that passes an attacker-influenced length to the reservation API, such as a length-prefixed streaming transport."
    }
  ],
  "id": "CVE-2026-72854",
  "lastModified": "2026-08-20T19:17:01.040",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "LOCAL",
          "availabilityImpact": "LOW",
          "baseScore": 5.3,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "NONE",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 1.0,
        "impactScore": 4.2,
        "source": "disclosure@vulncheck.com",
        "type": "Primary"
      }
    ],
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "HIGH",
          "attackRequirements": "PRESENT",
          "attackVector": "LOCAL",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 5.8,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "PASSIVE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "LOW",
          "vulnConfidentialityImpact": "NONE",
          "vulnIntegrityImpact": "HIGH",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "disclosure@vulncheck.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-72854",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-20T18:52:52.984726Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-20T19:17:01.040",
  "references": [
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/msgpack/msgpack-c"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/example/lib_buffer_unpack.c"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/include/msgpack/unpack.h#L219-L223"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/src/unpack.c#L429-L502"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://github.com/msgpack/msgpack-c/issues/1181"
    },
    {
      "source": "disclosure@vulncheck.com",
      "url": "https://www.vulncheck.com/advisories/msgpack-c-integer-overflow-in-msgpack-unpacker-expand-buffer-causes-a-false-success-undersized-reservation"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "url": "https://github.com/msgpack/msgpack-c/issues/1181"
    }
  ],
  "sourceIdentifier": "disclosure@vulncheck.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-190"
        },
        {
          "lang": "en",
          "value": "CWE-787"
        }
      ],
      "source": "disclosure@vulncheck.com",
      "type": "Primary"
    }
  ]
}

GHSA-P5JW-MM77-F8JP

Vulnerability from github – Published: 2026-08-20 21:31 – Updated: 2026-08-20 21:31

Details

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L

5.8 (Medium)


                  
                    CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-72854"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-190"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-08-20T19:17:01Z",
    "severity": "MODERATE"
  },
  "details": "msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the addition in the loop condition is unguarded, so a request near SIZE_MAX wraps: the loop condition is already satisfied, the allocation is performed at the small pre-wrap size, and the function returns true. The caller is told the requested capacity was reserved when it was not, so a subsequent write of the requested length overflows the heap buffer. The library\u0027s own example/lib_buffer_unpack.c demonstrates the reserve-then-write pattern, and its defensive assert comparing capacity against the request is compiled out under NDEBUG. msgpack-c\u0027s own decode entry points do not derive the reservation size from untrusted input, so reaching this requires an integration that passes an attacker-influenced length to the reservation API, such as a length-prefixed streaming transport.",
  "id": "GHSA-p5jw-mm77-f8jp",
  "modified": "2026-08-20T21:31:28Z",
  "published": "2026-08-20T21:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-72854"
    },
    {
      "type": "WEB",
      "url": "https://github.com/msgpack/msgpack-c/issues/1181"
    },
    {
      "type": "WEB",
      "url": "https://github.com/msgpack/msgpack-c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/example/lib_buffer_unpack.c"
    },
    {
      "type": "WEB",
      "url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/include/msgpack/unpack.h#L219-L223"
    },
    {
      "type": "WEB",
      "url": "https://github.com/msgpack/msgpack-c/blob/c-7.0.1/src/unpack.c#L429-L502"
    },
    {
      "type": "WEB",
      "url": "https://www.vulncheck.com/advisories/msgpack-c-integer-overflow-in-msgpack-unpacker-expand-buffer-causes-a-false-success-undersized-reservation"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

MSRC_CVE-2026-72854

Vulnerability from csaf_microsoft - Published: 2026-08-25 01:04 - Updated: 2026-08-25 01:04

Summary

msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation

Notes

Additional Resources: To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

Disclaimer: The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.

CVE-2026-72854

5.3 (Medium)


                        
                          CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L

CWE-190 - Integer Overflow or Wraparound

Affected products

Known affected 3 products

Product	Version	Remediation
Unresolved product id: 17084-3	—	None Available
Unresolved product id: 17084-1	—	None Available
Unresolved product id: 17084-2	—	None Available

References

4 references

URL	Category
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self
https://support.microsoft.com/lifecycle	external
https://www.first.org/cvss	external
https://msrc.microsoft.com/csaf/vex/2026/msrc_cve…	self

JSON

To clipboard

{
  "document": {
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2026-72854 msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation - VEX",
        "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-72854.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation",
    "tracking": {
      "current_release_date": "2026-08-25T01:04:54.000Z",
      "generator": {
        "date": "2026-08-25T07:02:58.269Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2026-72854",
      "initial_release_date": "2026-08-25T01:04:54.000Z",
      "revision_history": [
        {
          "date": "2026-08-25T01:04:54.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version",
                "name": "3.0",
                "product": {
                  "name": "Azure Linux 3.0",
                  "product_id": "17084"
                }
              }
            ],
            "category": "product_name",
            "name": "Azure Linux"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 fluent-bit 0:3.1.10-6.azl3",
                "product": {
                  "name": "azl3 fluent-bit 0:3.1.10-6.azl3",
                  "product_id": "3"
                }
              }
            ],
            "category": "product_name",
            "name": "fluent-bit"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 lttng-tools 0:2.13.11-1.azl3",
                "product": {
                  "name": "azl3 lttng-tools 0:2.13.11-1.azl3",
                  "product_id": "1"
                }
              }
            ],
            "category": "product_name",
            "name": "lttng-tools"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "azl3 msgpack 0:3.3.0-1.azl3",
                "product": {
                  "name": "azl3 msgpack 0:3.3.0-1.azl3",
                  "product_id": "2"
                }
              }
            ],
            "category": "product_name",
            "name": "msgpack"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 fluent-bit 0:3.1.10-6.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-3"
        },
        "product_reference": "3",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 lttng-tools 0:2.13.11-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-1"
        },
        "product_reference": "1",
        "relates_to_product_reference": "17084"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "azl3 msgpack 0:3.3.0-1.azl3 as a component of Azure Linux 3.0",
          "product_id": "17084-2"
        },
        "product_reference": "2",
        "relates_to_product_reference": "17084"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-72854",
      "cwe": {
        "id": "CWE-190",
        "name": "Integer Overflow or Wraparound"
      },
      "notes": [
        {
          "category": "general",
          "text": "VulnCheck",
          "title": "Assigning CNA"
        }
      ],
      "product_status": {
        "known_affected": [
          "17084-3",
          "17084-1",
          "17084-2"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-72854 msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation - VEX",
          "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-72854.json"
        }
      ],
      "remediations": [
        {
          "category": "none_available",
          "date": "2026-08-25T01:04:54.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-3"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-08-25T01:04:54.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-1"
          ]
        },
        {
          "category": "none_available",
          "date": "2026-08-25T01:04:54.000Z",
          "details": "There is no fix available for this vulnerability as of now",
          "product_ids": [
            "17084-2"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "temporalScore": 5.3,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "17084-3",
            "17084-1",
            "17084-2"
          ]
        }
      ],
      "title": "msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation"
    }
  ]
}

ubuntu-cve-2026-72854

Vulnerability from osv_ubuntu

Published

2026-08-21 00:00

Modified

2026-08-24 07:41

Summary

Details

(msgpack_unpacker_expand_buffer in src/unpack.c, reached through the pu ...)

Severity

5.3 (Medium)


                    
                      CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L

5.8 (Medium)


                    
                      CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

N/A (UNKNOWN)


                    
                      medium

References

URL

Type

	https://ubuntu.com/security/CVE-2026-72854	REPORT
	https://www.cve.org/CVERecord?id=CVE-2026-72854	REPORT

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmsgpackc2",
            "binary_version": "2.1.5-1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:18.04:LTS",
        "name": "msgpack-c",
        "purl": "pkg:deb/ubuntu/msgpack-c@2.1.5-1?arch=source\u0026distro=bionic"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "2.1.5-1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmsgpackc2",
            "binary_version": "3.0.1-3"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:20.04:LTS",
        "name": "msgpack-c",
        "purl": "pkg:deb/ubuntu/msgpack-c@3.0.1-3?arch=source\u0026distro=focal"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.0.1-3"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmsgpackc2",
            "binary_version": "3.3.0-4"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:22.04:LTS",
        "name": "msgpack-c",
        "purl": "pkg:deb/ubuntu/msgpack-c@3.3.0-4?arch=source\u0026distro=jammy"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.3.0-4"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmsgpackc2",
            "binary_version": "4.0.0-3build1"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:24.04:LTS",
        "name": "msgpack-c",
        "purl": "pkg:deb/ubuntu/msgpack-c@4.0.0-3build1?arch=source\u0026distro=noble"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "4.0.0-3",
        "4.0.0-3build1"
      ]
    },
    {
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "libmsgpack-c2",
            "binary_version": "6.1.0-2"
          }
        ]
      },
      "package": {
        "ecosystem": "Ubuntu:26.04:LTS",
        "name": "msgpack-c",
        "purl": "pkg:deb/ubuntu/msgpack-c@6.1.0-2?arch=source\u0026distro=resolute"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "6.0.1-3",
        "6.1.0-2"
      ]
    }
  ],
  "aliases": [],
  "details": "(msgpack_unpacker_expand_buffer in src/unpack.c, reached through the pu ...)",
  "id": "UBUNTU-CVE-2026-72854",
  "modified": "2026-08-24T07:41:36Z",
  "published": "2026-08-21T00:00:00Z",
  "references": [
    {
      "type": "REPORT",
      "url": "https://ubuntu.com/security/CVE-2026-72854"
    },
    {
      "type": "REPORT",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-72854"
    }
  ],
  "related": [],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:L/AC:H/AT:P/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    },
    {
      "score": "medium",
      "type": "Ubuntu"
    }
  ],
  "upstream": [
    "CVE-2026-72854"
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-72854 (GCVE-0-2026-72854)

FKIE_CVE-2026-72854

GHSA-P5JW-MM77-F8JP

MSRC_CVE-2026-72854

ubuntu-cve-2026-72854

Vulnerability from osv_ubuntu

Tags

Sightings

Nomenclature