# CVE-2026-72854: msgpack-c Integer Overflow in msgpack_unpacker_expand_buffer Causes a False-Success Undersized Reservation

CVE-2026-72854 is fixed in msgpack-c on 1 platform, first by DEBIAN-CVE-2026-72854, released August 20, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-72854
- Priority: Routine
- CVSS: 5.3 (Moderate)
- EPSS: 0.0016
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Aug 20, 2026
- Weakness: Integer Overflow or Wraparound
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-72854

## Description

msgpack_unpacker_expand_buffer in src/unpack.c, reached through the public msgpack_unpacker_reserve_buffer API, computes its new buffer size using an unchecked size_t addition of the requested size and the amount already used. The doubling loop guards its own multiplication against overflow, but the addition in the loop condition is unguarded, so a request near SIZE_MAX wraps: the loop condition is already satisfied, the allocation is performed at the small pre-wrap size, and the function returns true. The caller is told the requested capacity was reserved when it was not, so a subsequent write of the requested length overflows the heap buffer. The library's own example/lib_buffer_unpack.c demonstrates the reserve-then-write pattern, and its defensive assert comparing capacity against the request is compiled out under NDEBUG. msgpack-c's own decode entry points do not derive the reservation size from untrusted input, so reaching this requires an integration that passes an attacker-influenced length to the reservation API, such as a length-prefixed streaming transport.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | msgpack-c Debian 14 | 7.0.2-1 | [DEBIAN-CVE-2026-72854](https://patchblox.com/security/data/fix/linux/debian-cve-2026-72854.md) | Aug 20, 2026 |
| Linux | msgpack-c opensuse-leap 16.0 | 7.0.2-160000.1.1 | [OPENSUSE-SU-2026:21768-1](https://patchblox.com/security/data/fix/linux/opensuse-su-2026-21768-1.md) | Sep 6, 2026 |
| Linux | msgpack-c sles 16.0 | 7.0.2-160000.1.1 | [SUSE-SU-2026:23630-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-23630-1.md) | Sep 6, 2026 |

---

Data as of 2026-11-10T01:44:33Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.