{"id":"CVE-2026-88351","details":"An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count, the page allocation size calculation in mpack_tree_parse_children() can overflow size_t and produce an undersized allocation. Subsequent parsing writes mpack_node_data_t records beyond the allocated heap buffer, resulting in heap-buffer-overflow, memory corruption, and denial of service.","modified":"2026-09-26T08:04:15.887060Z","published":"2026-09-24T00:00:00Z","database_specific":{"cna_assigner":"mitre","osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88351.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88351.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-88351"},{"type":"REPORT","url":"https://github.com/ludocode/mpack/issues/123"},{"type":"FIX","url":"https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/ludocode/mpack","events":[{"introduced":"0"},{"fixed":"3d54d1215bdb5478d3ddecaf85884c58b382cd9b"}],"database_specific":{"source":"REFERENCES"}}],"versions":["v1.1.1","v1.1","v1.0","v0.8","v0.7.1","v0.7","v0.6","v0.5.1","v0.5","v0.4","v0.3","v0.2","v0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88351.json","vanir_signatures_modified":"2026-09-26T08:04:15Z","vanir_signatures":[{"signature_type":"Line","signature_version":"v1","source":"https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b","target":{"file":"src/mpack/mpack-platform.h"},"deprecated":false,"digest":{"line_hashes":["134114985431313568475531725662640486633","326475896255593249226536623334792904617","195636019037067069974526492084522433520","7647291496607415104410392393196425664","161329359478950106121882062351349499136","148438582230550467453999891100961925772","172951168611092304810127879482882296982","59282909036903436543694203090053868507","104959432097220956514102992630977654461","310703410902621982056484493920939568988","68359362286314421379550633674140460660","220818935085839064775305871753125067324","278303503470838405726977075912863604162","206477317074911773193808818670590599373"],"threshold":0.9},"id":"CVE-2026-88351-02d93c8c"},{"source":"https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b","target":{"file":"src/mpack/mpack-reader.c"},"deprecated":false,"digest":{"line_hashes":["206546651593704512819201060802903525632","92274785185808419563324714325453680440","337789682991149085389275308949126705406","266059725220556995011136956146555004204"],"threshold":0.9},"id":"CVE-2026-88351-2410434c","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"21709165583436065598785712405074811667","length":507},"id":"CVE-2026-88351-3a0c8f11","signature_type":"Function","signature_version":"v1","source":"https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b","target":{"file":"src/mpack/mpack-node.c","function":"mpack_tree_reserve_bytes"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"202098248838091100635918738264013372723","length":578},"id":"CVE-2026-88351-56726bce","signature_type":"Function","signature_version":"v1","source":"https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b","target":{"file":"src/mpack/mpack-reader.c","function":"mpack_read_bytes_alloc_impl"}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b","target":{"file":"src/mpack/mpack-node.c","function":"mpack_node_cstr_alloc"},"deprecated":false,"digest":{"function_hash":"211273342386618531264627726310780638168","length":854},"id":"CVE-2026-88351-5b48e8ad"},{"deprecated":false,"digest":{"function_hash":"211273342386618531264627726310780638168","length":854},"id":"CVE-2026-88351-62a26c23","signature_type":"Function","signature_version":"v1","source":"https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b","target":{"file":"src/mpack/mpack-node.c","function":"mpack_node_utf8_cstr_alloc"}},{"source":"https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b","target":{"file":"src/mpack/mpack-node.c"},"deprecated":false,"digest":{"line_hashes":["336467402232554008006095521988324552709","98147249126477827410188671532614969719","47986807282682011949487265560486412299","225900805345574462693218222296053309108","217979798596659606024510427840962776443","32431311063107430533214628165014513749","288300643188516365557321143997166614329","235608423939302046198294751261338698489","114986593260555629666746564088702130747","77835347133786540433124161091397482965","314487407362405077064157177147255584043","204946828916679119100435267081151522160","153029592123302311435580500984486563524","276924999144375692851068177412395640250","2038572795316649061027920051338300128","318582466350697282357646762701666453512","172868765786967298101388718028823545562","429357351862965631037666989651017568","136330617788040211009001627890025310030","279745756761454532046586821843124597629","242402823214316651457850817053352356064","203056113437415105473740319634177661142","196919776399781612808252215425236076987","201043746515437138179941118733334847516","117429183846590683013676250351001748532","19424957821787546425203878492380901367","318038032657886262469628779661031368895","111125997405712485795845841000398424697","85119225527511782115614405903583304951","268629568360586192827340494950851544064","303659436335047846079390582388809723410","326400538913878746555207552360420422512","219270325235822676889796459913933941696","240082686626574144678563664481548234380","339568951502023328656572706595419429625","327626749469177226008848329847372342648","328582550280512913474833248299881647604","170234490051347231795437596880127564200","73851040281652141782493381473361993292","185786833281451760895852134623009535897","219270325235822676889796459913933941696","240082686626574144678563664481548234380","339568951502023328656572706595419429625","327626749469177226008848329847372342648","328582550280512913474833248299881647604","170234490051347231795437596880127564200","73851040281652141782493381473361993292","185786833281451760895852134623009535897"],"threshold":0.9},"id":"CVE-2026-88351-7adce31e","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b","target":{"file":"src/mpack/mpack-writer.c","function":"mpack_growable_writer_flush"},"deprecated":false,"digest":{"function_hash":"183993625131744956039804621295526464970","length":1185},"id":"CVE-2026-88351-7d336611","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2026-88351-996337a4","signature_type":"Function","signature_version":"v1","source":"https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b","target":{"file":"src/mpack/mpack-node.c","function":"mpack_tree_parse_children"},"deprecated":false,"digest":{"function_hash":"55644624274819820945587898720498436000","length":1922}},{"signature_version":"v1","source":"https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b","target":{"file":"src/mpack/mpack-node.c","function":"mpack_tree_reserve_fill"},"deprecated":false,"digest":{"function_hash":"67938714778323247099291424490566486837","length":1882},"id":"CVE-2026-88351-bfb6350b","signature_type":"Function"},{"deprecated":false,"digest":{"line_hashes":["92181309082125494625966943361966667685","308303128621561714552536526046939983488","269247216766000980178684944988870531830","73942333486967406668885420734784837811","100055841584776475880693629605528409476","147349125951277310989280158645712989426","245457086971826548020508589208868121854","19003798717799923704607512326718914851","253431897713949885653285931192316191503","199494567900746542844299831532195444358","305623364183490821511173700216602033416","214650788507505408146384322850950080051"],"threshold":0.9},"id":"CVE-2026-88351-c0d7c8bc","signature_type":"Line","signature_version":"v1","source":"https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b","target":{"file":"src/mpack/mpack-writer.c"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}