{"id":"CVE-2026-48109","aliases":["GHSA-hv8m-jj95-wg3x"],"url":"https://o3.security/vulnerability/CVE-2026-48109","summary":"MessagePack-CSharp: LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input","details":"### Impact\n\nA vulnerability exists in the optional LZ4 decompression path used by MessagePack compression modes `Lz4Block` and `Lz4BlockArray`.\n\nThe decoder implementation is based on a deprecated fast-decompression algorithm that does not take a source-length bound. A remote attacker can send a crafted MessagePack payload with manipulated LZ4 token/length fields to force out-of-bounds reads from the compressed input buffer. In affected environments, this can trigger an `AccessViolationException` during decompression, causing process termination (denial of service). Under some conditions, limited unintended memory disclosure from over-read data may also be possible before failure.\n\nThis issue affects applications that deserialize untrusted data while LZ4 compression is enabled.\n\n### Patches\n\nThe v2 versions are patched as of 2.5.301.\nThe v3 versions are patched as of 3.1.7.\n\n### Workarounds\n\nInstead of upgrading, an application may take the following precautions:\n\n1. Disable LZ4 compression for untrusted input paths (`Lz4Block`, `Lz4BlockArray`).\n2. Only accept compressed payloads from strongly trusted producers.\n3. Isolate deserialization in a separate process/container with restart supervision to limit availability impact.\n\n### Resources\n\n- MESSAGEPACKCSHARP-010","published":"2026-06-22T21:19:54.234Z","modified":"2026-08-27T03:30:29.503015495Z","cvss":{"score":8.2,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H"},"epss":{"score":0.00509,"percentile":0.41084,"asOf":"2026-08-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"NuGet","name":"MessagePack","fixedVersion":"2.5.301"},{"ecosystem":"NuGet","name":"MessagePack","fixedVersion":"3.1.7"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/48xxx/CVE-2026-48109.json"},{"type":"ADVISORY","url":"https://github.com/MessagePack-CSharp/MessagePack-CSharp/security/advisories/GHSA-hv8m-jj95-wg3x"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-48109"},{"type":"PACKAGE","url":"https://github.com/MessagePack-CSharp/MessagePack-CSharp"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-27T03:30:29.503015495Z"}}