CVE-2026-72854: Integer Overflow or Wraparound in msgpack msgpack-c

The vulnerability exists in msgpack_unpacker_expand_buffer in src/unpack.c, accessed via the public API msgpack_unpacker_reserve_buffer. The function computes the new buffer size by adding the requested size to the amount already used without proper overflow checks. Although the doubling loop guards multiplication overflow, the addition in the loop condition is unchecked, allowing a wraparound near SIZE_MAX. This results in allocation of a smaller buffer than requested, but the function returns success. Subsequent writes overflow the heap buffer. The vulnerability requires an integration scenario where attacker-influenced lengths are passed to the reservation API, such as length-prefixed streaming transports. The library's own decode entry points do not expose this risk directly.

Successful exploitation can cause a heap buffer overflow leading to integrity violations and potential denial of service. The CVSS score is 5.3 (medium severity) with impact on integrity and availability. There is no indication of confidentiality impact. Exploitation requires local access or a high attack complexity with no privileges and user interaction.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid passing untrusted or attacker-controlled length values to the msgpack_unpacker_reserve_buffer API. Use msgpack-c's decode entry points as intended, which do not derive reservation sizes from untrusted input.