The vulnerability in msgpack-java (<=0.9.12) arises from an integer overflow in the skipValue() method of the MessageUnpacker class when handling MAP32 containers with very large element counts. Specifically, if the element count is at or above 0x40000000, doubling this count causes an overflow or wraparound, which results in the parser cursor becoming desynchronized. This desynchronization can cause the parser to return attacker-controlled data in place of legitimate subsequent fields, potentially leading to data integrity issues or other impacts depending on usage.

An attacker can craft a malicious MAP32 container with a large element count that triggers an integer overflow during parsing. This can cause the parser to desynchronize and return attacker-controlled data instead of expected fields. The impact is primarily on data integrity and correctness of parsing, which could lead to application logic errors or other downstream effects. No direct privilege escalation or denial of service is indicated. The CVSS 4.0 base score is 6.9 (medium severity).

No vendor advisory or patch information is provided in the input data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid processing untrusted MAP32 containers with large element counts or implement input validation to restrict element counts below the overflow threshold.