The vulnerability in MessagePack-CSharp affects the UnsafeBlitFormatterBase<T>.Deserialize method used by Unity blit resolvers such as UnityBlitResolver and UnityBlitWithPrimitiveArrayResolver. It occurs because the method reads a byteLength value from an extension payload and allocates an array of that size before validating that the byteLength is within the bounds of the actual extension payload. This allows an attacker to specify a large byteLength in a small payload, causing excessive memory allocation. The vulnerability impacts applications that deserialize untrusted payloads using these resolvers, particularly Unity multiplayer clients or servers using MessagePack-CSharp for networked data like vectors or arrays. Fixes are planned to validate byteLength before allocation, rejecting invalid or oversized lengths. Until patched versions are released, users are advised to avoid using vulnerable resolvers on untrusted data or to apply explicit validation and size limits before deserialization.

An attacker can cause an application using vulnerable Unity blit resolvers to allocate large amounts of memory based on attacker-controlled input, potentially leading to out-of-memory exceptions or process termination, especially on memory-constrained platforms. This impacts the stability and availability of applications deserializing untrusted data with these resolvers.

Patching is recommended once the coordinated patched versions of MessagePack.UnityClient and companion packages are released. The fix will validate the byteLength before allocation to prevent excessive memory allocation. Until patches are available, do not use Unity blit resolvers (UnityBlitResolver or UnityBlitWithPrimitiveArrayResolver) on data received from untrusted peers. Instead, use safer resolvers or explicitly validate and size-limit messages before deserialization.