CVE-2026-48109: MessagePack for C# LZ4 Decompression Out-of-Bounds Read (CVSS 8.2)

Technical summary

The vulnerability stems from the use of a deprecated fast-decompression algorithm in the LZ4 decoder path that lacks proper source-length boundary checking. An attacker can manipulate LZ4 token and length fields within a crafted MessagePack payload to induce out-of-bounds reads from the compressed input buffer. The decoder does not validate that decompression operations remain within the allocated buffer bounds, enabling both denial of service via AccessViolationException and potential information disclosure through over-read memory access. The issue affects MessagePack versions prior to 2.5.301 and 3.1.7 when LZ4 compression modes are enabled.

Business impact

Services relying on MessagePack for C# with LZ4 compression enabled face immediate availability risk. An unauthenticated remote attacker can force application crashes by sending a single malicious message, resulting in service interruption without requiring authentication or user interaction. For systems processing high-volume or user-generated MessagePack data, this becomes a trivial denial-of-service vector. Additionally, memory disclosure may expose sensitive information from adjacent heap or stack regions, though limited in scope. Organizations using MessagePack in microservices, real-time data pipelines, or message brokers should prioritize assessment.

Affected systems

MessagePack for C# versions prior to 2.5.301 (2.x line) and prior to 3.1.7 (3.x line) are vulnerable. The exposure is limited to applications that: (1) use MessagePack for C# as their serialization library, (2) explicitly enable Lz4Block or Lz4BlockArray compression modes, and (3) deserialize MessagePack data from untrusted sources or network endpoints. Applications using uncompressed MessagePack or alternative compression modes (e.g., Deflate) are not affected. Verify your dependency tree and compression configuration to determine exposure.

Exploitability

Exploitation requires only network access and the ability to send a crafted MessagePack message to the vulnerable application—no authentication, special privileges, or user interaction needed. The attack is straightforward to execute once an attacker identifies a service using vulnerable MessagePack versions with LZ4 compression. The CVSS score of 8.2 (HIGH) reflects the low barrier to exploitation, lack of authentication requirement, and high availability impact, tempered slightly by the requirement that LZ4 compression be explicitly enabled.

Remediation

Upgrade MessagePack for C# to version 2.5.301 or later (for 2.x users) or version 3.1.7 or later (for 3.x users). These releases patch the LZ4 decompression algorithm with proper boundary checking. After patching, restart all affected services. If immediate patching is not feasible, disable Lz4Block and Lz4BlockArray compression modes and use alternative serialization options (uncompressed MessagePack or other compression modes) until updates can be applied.

Patch guidance

Check your project's dependency manifest (packages.config, .csproj, or package.json) to identify the current MessagePack for C# version. If running 2.x line, update to 2.5.301 or later. If running 3.x line, update to 3.1.7 or later. Verify the update in a non-production environment first, particularly if LZ4 compression is actively used, to ensure compatibility with your message format expectations. Rebuild and redeploy applications. Monitor vendor advisories for any post-release guidance or additional patches.

Detection guidance

Monitor application logs and event viewers for AccessViolationException errors originating from MessagePack decompression routines, particularly after receiving network messages. Implement network-based detection by identifying MessagePack frames with suspicious or malformed LZ4 token sequences—look for token/length combinations that would exceed the declared compressed buffer size. If feasible, capture and analyze MessagePack traffic from untrusted sources for anomalies before passing to the deserializer. Application performance monitoring (APM) tools can flag unusual crash patterns that may indicate exploitation attempts.

Why prioritize this

This vulnerability merits urgent attention due to its combination of unauthenticated remote exploitability, high availability impact, and low complexity. Any exposed service using MessagePack with LZ4 compression is a trivial denial-of-service target. The potential for limited memory disclosure adds a secondary confidentiality risk. Organizations processing customer data or operating mission-critical services should prioritize patching within their standard update cycle, typically within 1–2 weeks. The fact that it is not yet tracked in the CISA KEV catalog suggests a brief window before widespread exploitation attempts materialize.

Risk score, explained

The CVSS 3.1 score of 8.2 (HIGH) is driven by: (1) Network accessibility (AV:N) with no authentication required (PR:N) and no user interaction (UI:N), making the attack trivial to launch; (2) High availability impact (A:H) from process termination; (3) Low confidentiality impact (C:L) from potential memory disclosure; (4) No integrity impact (I:N). The score appropriately reflects a severe but targeted vulnerability affecting a specific serialization library feature rather than a universal platform weakness.

Frequently asked questions