# CVE-2026-44375: Nerdbank — Fixed in 1.1.62 .NET .NET NuGet Not in CISA KEV HIGH severity # CVE-2026-44375 — Nerdbank.MessagePack HIGH [Fix: AArnott/Nerdbank.MessagePack@7d1eb31](https://github.com/AArnott/Nerdbank.MessagePack/commit/7d1eb319cfabe7280e70699946c9a48579fa2f30) CVE-2026-44375 is a high-severity (CVSS 7.5) CWE-789 vulnerability in Nerdbank.MessagePack. A fix is available for Nerdbank.MessagePack — see the affected versions and patch details below. Nerdbank.MessagePack: Attacker-controlled stackalloc in DateTime decoding causes process-terminating StackOverflowException Also known as[GHSA-2cwq-pwfr-wcw3](/vulnerability/GHSA-2cwq-pwfr-wcw3) Published May 14, 2026 Updated Oct 28, 2026 Affected 1 pkg Patched 1 / 1 Exploits None indexed Exploitation data as of Nov 7, 2026 · OSV.dev, NVD, FIRST.org (EPSS) ## Exploitation Status ### No confirmed exploitation observed yet - CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks. - CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment. Exploitation and automatability from CISA’s SSVC triage for CVE-2026-44375. ## EPSS Exploitation Probability [via FIRST.org ↗](https://www.first.org/epss/) 0.4%probability of exploitation in next 30 days Lower Risk0.00% Lower risk than most CVEs29th percentile — riskier than 29% of all scored CVEsHighest risk 0.00%0.38%0.75%1.13%0.1%0.4%Jun 26Sep 26Nov 26 Probability of exploitation in the next 30 days, from [FIRST.org EPSS](https://www.first.org/epss/). ## How urgent is this, really ## Where this sits among everything scored ## Real-World Exposure 1 pkg affected .NET`Nerdbank.MessagePack` Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects NuGet packages — download data is not available via public APIs for these ecosystems. ## Description #### Summary Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, causing the reader to allocate an attacker-controlled number of bytes on the stack. This can trigger a `StackOverflowException`, which is not catchable by user code and terminates the process. #### Impact Applications are impacted if they deserialize MessagePack data from untrusted or attacker-controlled sources using Nerdbank.MessagePack and the target type contains a `DateTime` value. A small malicious payload can cause process termination, resulting in a denial of service. This may affect services, APIs, workers, message consumers, or other long-running processes that deserialize untrusted MessagePack input. The issue occurs because DateTime timestamp extension decoding derives `tokenSize` from the attacker-controlled extension length before validating that the timestamp length is one of the legal MessagePack timestamp sizes: 4, 8, or 12 bytes. When the buffer is incomplete, that unvalidated size is propagated to the streaming reader slow path, where it is used in a `stackalloc`. #### Patches The 1.1.62 version contains the fix for this security vulnerability. #### Workarounds If upgrading is not yet possible, avoid deserializing untrusted MessagePack payloads into type graphs that may contain `DateTime` fields or properties. Input byte-size limits alone may not fully mitigate this issue, because the malicious payload can be small while declaring a very large extension length. Possible mitigations include: - Pre-validating MessagePack extension headers before deserialization and rejecting timestamp extensions whose length is not 4, 8, or 12 bytes. - Rejecting or filtering extension type `-1` timestamp values from untrusted input unless they are known to be valid. - Running deserialization of untrusted payloads in an isolated process that can be safely restarted after termination. - Restricting MessagePack deserialization to trusted producers until a patched version is available. #### Resources - CWE-789: Uncontrolled Memory Allocation: [https://cwe.mitre.org/data/definitions/789.html](https://cwe.mitre.org/data/definitions/789.html) - MessagePack timestamp extension specification: [https://github.com/msgpack/msgpack/blob/master/spec.md#timestamp-extension-type](https://github.com/msgpack/msgpack/blob/master/spec.md#timestamp-extension-type) ## Affected Packages 1 total 1 fixed Ecosystem Package Vulnerable range Fix .NETNuGet `Nerdbank.MessagePack` all versions 1.1.62`dotnet add package Nerdbank.MessagePack --version 1.1.62` ## Detection & mitigation playbook Open-source dependency 1. ### Detect Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for Nerdbank.MessagePack, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version. 2. ### Fix Update Nerdbank.MessagePack to 1.1.62 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-44375 is resolved across your whole dependency graph. 3. ### Workarounds Stop feeding it untrusted input: reject or quarantine files and payloads from unverified sources until you can upgrade, restrict accepted formats to the ones you actually need, and run the parsing or decoding step in a least-privileged sandbox or short-lived worker so a crash or corrupted read cannot reach the rest of the process. ## Frequently Asked Questions \### Summary Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, causing the reader to allocate an attacker-controlled number of bytes on the stack. This can trigger a \`StackOverflowException\`, which is not catchable by user code and terminates the process. ### Impact Applications are impacted if they deserialize MessagePack data from untrusted or attacker-controlled sources using Nerdbank.MessagePack and the target type contains a \`DateTime\` value. A small mal O3 Security · Impact-Aware SCA ### Is CVE-2026-44375 in your dependencies? Find it across NuGet, including transitive dependencies. [Scan my dependencies](/book-demo) [How O3 SCA works](/impact-aware-sca)