CVE-2026-44375

{
  "id": "CVE-2026-44375",
  "sourceIdentifier": "[email protected]",
  "published": "2026-05-14T15:16:48.383",
  "lastModified": "2026-10-26T14:10:00.130",
  "vulnStatus": "Deferred",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Nerdbank.MessagePack is a NativeAOT-compatible MessagePack serialization library. Prior to 1.1.62, Nerdbank.MessagePack contains an uncontrolled stack allocation vulnerability in DateTime decoding. A malicious MessagePack payload can declare an oversized timestamp extension length, causing the reader to allocate an attacker-controlled number of bytes on the stack. This can trigger a StackOverflowException, which is not catchable by user code and terminates the process. This vulnerability is fixed in 1.1.62."
    },
    {
      "lang": "es",
      "value": "Nerdbank.MessagePack es una biblioteca de serialización MessagePack compatible con NativeAOT. Antes de la versión 1.1.62, Nerdbank.MessagePack contiene una vulnerabilidad de asignación de pila incontrolada en la decodificación de DateTime. Una carga útil MessagePack maliciosa puede declarar una longitud de extensión de marca de tiempo excesiva, lo que hace que el lector asigne un número de bytes controlado por el atacante en la pila. Esto puede desencadenar una StackOverflowException, que no es capturable por el código de usuario y termina el proceso. Esta vulnerabilidad está corregida en la versión 1.1.62."
    }
  ],
  "affected": [
    {
      "source": "[email protected]",
      "affectedData": [
        {
          "vendor": "AArnott",
          "product": "Nerdbank.MessagePack",
          "versions": [
            {
              "version": "< 1.1.62",
              "status": "affected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "[email protected]",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "timestamp": "2026-05-14T16:01:58.538455Z",
          "id": "CVE-2026-44375",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "version": "2.0.3"
        }
      }
    ]
  },
  "weaknesses": [
    {
      "source": "[email protected]",
      "type": "Secondary",
      "description": [
        {
          "lang": "en",
          "value": "CWE-789"
        }
      ]
    }
  ],
  "references": [
    {
      "url": "https://github.com/AArnott/Nerdbank.MessagePack/commit/7d1eb319cfabe7280e70699946c9a48579fa2f30",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/AArnott/Nerdbank.MessagePack/pull/941",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/AArnott/Nerdbank.MessagePack/releases/tag/v1.1.62",
      "source": "[email protected]"
    },
    {
      "url": "https://github.com/AArnott/Nerdbank.MessagePack/security/advisories/GHSA-2cwq-pwfr-wcw3",
      "source": "[email protected]"
    }
  ]
}