{"id":"CVE-2026-88351","title":"An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms","summary":"An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count, the page allocation size cal…","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwe":["CWE-190"],"published":"2026-09-24","updated":"2026-09-25","sourceUpdated":"2026-09-25T18:17:31.257","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-88351","references":[{"url":"https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b","label":"cve@mitre.org"},{"url":"https://github.com/ludocode/mpack/issues/123","label":"cve@mitre.org"},{"url":"https://github.com/ludocode/mpack/issues/123","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"}],"tags":["nvd","cve.org","exploit-available"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-25T18:09:19.298466Z"},"ingestedAt":"2026-09-24T15:45:56.648Z","slug":"CVE-2026-88351","body":"## Overview\n\nAn integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count, the page allocation size calculation in mpack_tree_parse_children() can overflow size_t and produce an undersized allocation. Subsequent parsing writes mpack_node_data_t records beyond the allocated heap buffer, resulting in heap-buffer-overflow, memory corruption, and denial of service.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":66,"depthScoreParts":{"impact":53.9,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[{"seq":211117,"id":"CVE-2026-88351","ts":1790360112026,"field":"exploit_available","old":"false","new":"true"},{"seq":211116,"id":"CVE-2026-88351","ts":1790360112026,"field":"cvss","old":null,"new":"9.8"},{"seq":211115,"id":"CVE-2026-88351","ts":1790360112026,"field":"severity","old":"none","new":"critical"}]}