The vulnerability in msgpack-c (CVE-2026-72854) arises from an unchecked size_t addition in the msgpack_unpacker_expand_buffer function, which is called through the public msgpack_unpacker_reserve_buffer API. Although the doubling loop protects against multiplication overflow, the addition in the loop condition is unguarded, allowing a request size near SIZE_MAX to wrap around. This causes the function to allocate a smaller buffer than requested but still return success, misleading the caller. Subsequent writes of the requested length overflow the heap buffer. The library's own example demonstrates the reserve-then-write pattern, but defensive asserts are disabled under NDEBUG. Exploitation requires an integration that passes attacker-influenced length values to the reservation API, such as length-prefixed streaming transports. The vulnerability affects msgpack-c versions up to 7.0.1. No vendor advisory or patch information is currently available.

A heap buffer overflow can occur if an attacker controls the length parameter passed to the msgpack_unpacker_reserve_buffer API, potentially leading to memory corruption. The CVSS score of 5.3 reflects a medium severity with local attack vector, high attack complexity, no privileges required, and user interaction needed. The impact includes integrity and availability loss but no confidentiality impact is indicated. Exploitation requires specific integration conditions and is not directly exploitable via msgpack-c's own decode entry points.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid passing untrusted or attacker-controlled length values to the msgpack_unpacker_reserve_buffer API. Review integrations that use length-prefixed streaming transports or similar mechanisms to ensure they do not expose this vulnerability.