Description

msgpack-java through 0.9.12 contains an integer overflow vulnerability in MessageUnpacker.skipValue() when processing MAP32 containers with large element counts. Attackers can supply a MAP32 element count at or above 0x40000000 that wraps when doubled, causing the parser cursor to desynchronize and attacker-controlled data to be returned in place of later fields.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-12T11:16:34.347Z",
  "pubdate": "2026-09-12T11:16:34.347Z",
  "executiveSummary": "The msgpack-java library, specifically versions up to 0.9.12, is susceptible to an integer overflow vulnerability within the MessageUnpacker.skipValue() function. This flaw arises during the deserialization of MAP32 containers containing an excessive number of elements.\nBy crafting a malicious MAP32 payload with an element count at or exceeding 0x40000000, an attacker can trigger an integer overflow when the library performs arithmetic operations (doubling the count) for memory management or parsing traversal. This overflow causes the parser's internal cursor to calculate an incorrect offset, leading to state desynchronization.\nThe primary impact of this vulnerability is the potential for the parser to return attacker-controlled data as legitimate subsequent fields within the deserialized object. This constitutes a severe integrity vulnerability that could lead to unauthorized data injection, bypass of security checks, or arbitrary application logic manipulation. Exploitation requires the victim application to process untrusted MessagePack data. No specific authentication is required to trigger the overflow, as it is a parsing-level defect reachable via malformed input packets provided to the library's API.",
  "technicalDetails": "The vulnerability resides within the MessageUnpacker.skipValue() method in the msgpack-java library. MessagePack represents a map with a MAP32 type indicator when the number of key-value pairs exceeds the capacity of a 16-bit integer. The specification allows for 32-bit element counts in these structures.\nThe root cause is an integer overflow occurring during the calculation of memory requirements or buffer traversal for these large maps. Specifically, the library performs an arithmetic operation—doubling the provided element count—to account for both the keys and the values within the map structure. When an attacker supplies an element count greater than or equal to 0x40000000 (decimal 1,073,741,824), the doubling operation results in an integer wrap-around. This produces a small or negative value in signed 32-bit arithmetic, causing the internal buffer pointer or the skip logic to truncate prematurely.\nThe exploitation flow begins when an attacker delivers a serialized MessagePack payload containing a MAP32 header with a high element count. Upon reaching the skipValue() logic, the library validates the structure size; however, the lack of checked arithmetic allows the overflow to bypass boundary constraints. Because the internal cursor is improperly calculated, the library misidentifies the end of the current object. Consequently, subsequent data segments in the stream are treated as part of the current container or are incorrectly skipped. This desynchronization forces the parser to return arbitrary attacker-supplied bytes that follow the MAP32 container, mapping them into the application's object model as if they were valid field values.\nThis vulnerability is reachable via standard library calls that parse untrusted byte arrays or streams. No special privileges are required, and the attack is entirely network-accessible if the affected application exposes a MessagePack-based API or consumes MessagePack-formatted messages from a remote source. The post-exploitation impact is context-dependent; if the application uses the result of the deserialization to make control flow decisions or to populate object state, an attacker may achieve significant subversion of the application's intended logic, effectively performing an injection attack through binary deserialization corruption."
}