CVE-2026-88350: MPack 1.1.1 Buffer Overflow Vulnerability

CVE-2026-88350 Overview

CVE-2026-88350 is an integer overflow vulnerability in MPack 1.1.1, a C/C++ implementation of the MessagePack serialization format. The flaw resides in the mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc() functions, which allocate memory for C-string representations of MessagePack node data. When the requested string length approaches the maximum value of size_t, adding one byte for the null terminator wraps the size to zero or a small value. This causes an undersized allocation followed by an out-of-bounds write when the string contents are copied. Applications that parse untrusted MessagePack data using the affected functions may experience memory corruption or denial of service.

Critical Impact
Parsing attacker-controlled MessagePack input through the vulnerable allocation functions can trigger heap memory corruption, enabling denial of service and potentially exploitable memory safety violations.

Affected Products

MPack library version 1.1.1
mpack_node_cstr_alloc() function in src/mpack/mpack-reader.c
mpack_node_utf8_cstr_alloc() function in the MPack reader module

Discovery Timeline

2026-09-22 - CVE-2026-88350 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-88350

Vulnerability Analysis

The vulnerability arises from an unchecked arithmetic operation in the allocation size calculation. The original code computed count + (null_terminated ? 1 : 0) and passed the result directly to MPACK_MALLOC. A source comment // TODO: can this overflow? in the pre-patch code acknowledged the risk was known but unresolved. When count equals SIZE_MAX, the addition wraps to zero, and malloc(0) may return a valid pointer to a zero- or small-sized region. Subsequent memcpy or string operations write past the allocation boundary, corrupting adjacent heap metadata.

Root Cause

The root cause is missing overflow validation before integer addition [CWE-190]. The MPack reader trusts the length field embedded in the MessagePack stream and derives allocation size from it without invoking a checked-addition helper. Because MessagePack length prefixes can reach 32-bit or 64-bit ranges, an attacker who controls the serialized payload can specify a length that triggers the wrap.

Attack Vector

Exploitation requires that the target application decode MessagePack data from an untrusted source using mpack_node_cstr_alloc() or mpack_node_utf8_cstr_alloc(). Network services, file parsers, and IPC endpoints that accept MessagePack payloads are typical attack surfaces. No authentication is inherent to the library itself; exposure depends on how the consuming application receives input.

// Security patch in src/mpack/mpack-reader.c - Add overflow checks
     if (count == 0 && null_terminated == false)
         return NULL;
 
+    // calculate size to allocate
+    size_t size = count;
+    if (null_terminated && mpack_checked_add_z(&size, size, 1)) {
+        mpack_reader_flag_error(reader, mpack_error_memory);
+        return NULL;
+    }
+
     // allocate data
-    char* data = (char*)MPACK_MALLOC(count + (null_terminated ? 1 : 0)); // TODO: can this overflow?
+    char* data = (char*)MPACK_MALLOC(size);
     if (data == NULL) {
         mpack_reader_flag_error(reader, mpack_error_memory);
         return NULL;

Source: GitHub Commit 3d54d12

The patch introduces mpack_checked_add_z() to validate the addition of the null-terminator byte and flags a memory error if the operation would overflow.

Detection Methods for CVE-2026-88350

Indicators of Compromise

Application crashes with SIGSEGV or SIGABRT during MessagePack deserialization
Heap corruption diagnostics from allocators such as glibc malloc_check, jemalloc, or AddressSanitizer
Unusually large length prefixes observed in MessagePack payloads arriving over the network

Detection Strategies

Perform software composition analysis on binaries and container images to identify statically linked MPack 1.1.1
Enable AddressSanitizer (-fsanitize=address) in test builds to detect out-of-bounds writes in fuzzed MessagePack corpora
Deploy fuzz harnesses targeting mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc() with mutation on length fields

Monitoring Recommendations

Log parser errors and abnormal termination events in services that ingest MessagePack data
Monitor for repeated malformed payload rejections from perimeter or service-mesh telemetry
Track memory allocator error flags emitted by the mpack_reader_flag_error() path

How to Mitigate CVE-2026-88350

Immediate Actions Required

Inventory all applications and libraries that embed MPack 1.1.1 or earlier
Rebuild affected software against a patched MPack source tree containing commit 3d54d12
Restrict network exposure of services that deserialize untrusted MessagePack input until patched

Patch Information

The upstream fix is available as commit 3d54d1215bdb5478d3ddecaf85884c58b382cd9b in the ludocode/mpack repository. The patch introduces checked arithmetic through mpack_checked_add_z() before invoking MPACK_MALLOC, and it flags mpack_error_memory when the addition would overflow. Consumers should update to a release incorporating this commit or apply the patch directly against a vendored copy of MPack. Refer to the GitHub Issue #124 Discussion for context on the reported behavior.

Workarounds

Enforce upstream length limits on MessagePack strings before passing data to the vulnerable functions
Use alternative parsing paths that do not rely on mpack_node_cstr_alloc() or mpack_node_utf8_cstr_alloc()
Wrap MessagePack decoding in a sandboxed process or restricted memory cgroup to contain corruption

bash

# Configuration example: rebuild application with patched MPack and hardening flags
git -C third_party/mpack fetch origin
git -C third_party/mpack checkout 3d54d1215bdb5478d3ddecaf85884c58b382cd9b
cmake -S . -B build -DCMAKE_C_FLAGS="-D_FORTIFY_SOURCE=2 -fstack-protector-strong -fsanitize=address"
cmake --build build --clean-first