Hi,

The following vulnerability was published for msgpack-c.

CVE-2026-72854[0]:
| msgpack_unpacker_expand_buffer in src/unpack.c, reached through the
| public msgpack_unpacker_reserve_buffer API, computes its new buffer
| size using an unchecked size_t addition of the requested size and
| the amount already used. The doubling loop guards its own
| multiplication against overflow, but the addition in the loop
| condition is unguarded, so a request near SIZE_MAX wraps: the loop
| condition is already satisfied, the allocation is performed at the
| small pre-wrap size, and the function returns true. The caller is
| told the requested capacity was reserved when it was not, so a
| subsequent write of the requested length overflows the heap buffer.
| The library's own example/lib_buffer_unpack.c demonstrates the
| reserve-then-write pattern, and its defensive assert comparing
| capacity against the request is compiled out under NDEBUG.
| msgpack-c's own decode entry points do not derive the reservation
| size from untrusted input, so reaching this requires an integration
| that passes an attacker-influenced length to the reservation API,
| such as a length-prefixed streaming transport.


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-72854
https://www.cve.org/CVERecord?id=CVE-2026-72854
[1] https://github.com/msgpack/msgpack-c/issues/1181
[2] https://github.com/msgpack/msgpack-c/commit/8a48af0e3ed15ce0e60273de30a073ae6419489e

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore

We believe that the bug you reported is fixed in the latest version of
msgpack-c, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1150652@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
James McCoy <jamessan@debian.org> (supplier of updated msgpack-c package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Sun, 11 Oct 2026 21:10:19 -0400
Source: msgpack-c
Architecture: source
Version: 7.0.2-1
Distribution: unstable
Urgency: medium
Maintainer: James McCoy <jamessan@debian.org>
Changed-By: James McCoy <jamessan@debian.org>
Closes: 1150652
Changes:
 msgpack-c (7.0.2-1) unstable; urgency=medium
 .
   * New upstream release
     + Fix integer overflow in msgpack_unpacker_expand_buffer (Closes:
       #1150652, CVE-2026-72854)
Checksums-Sha1:
 eb8529867c4830252ea7bb0270f879781c456cb2 2518 msgpack-c_7.0.2-1.dsc
 6e0130591cdd067b3ca425212d76982591837f2f 58524 msgpack-c_7.0.2.orig.tar.xz
 6816cc9ff3af9a5c3bcc6c6a1982a992bffe2289 8112 msgpack-c_7.0.2-1.debian.tar.xz
 98226ddaeca52cba5dab1178ef6f8d39622d5484 132792 msgpack-c_7.0.2-1.git.tar.xz
 335a91fac00c870b99590c66314ecb038ada6226 17732 msgpack-c_7.0.2-1_source.buildinfo
Checksums-Sha256:
 f0fe98f959eb0b250b0d1e37e88b84fb852887d791e129ac451c29711d816ad0 2518 msgpack-c_7.0.2-1.dsc
 9140bea1d8e7242645be05224992cf61734840bb456cf3d9dbdae2841492bbdc 58524 msgpack-c_7.0.2.orig.tar.xz
 531e2656cdcfe57bceae84e16e674d979ed0567778d83c19b1af8f9a1c88e47d 8112 msgpack-c_7.0.2-1.debian.tar.xz
 3a99934b9c6e8ea4b7f4e1fbc23e60cdb002c040439d5c0dd001ea66752eb6b3 132792 msgpack-c_7.0.2-1.git.tar.xz
 838a041d09f9671f44a66a0441bb80385be49cfdfb22170211454e5a81b82f4f 17732 msgpack-c_7.0.2-1_source.buildinfo
Files:
 8783140c4b66882e11b119ae17b3a735 2518 libs optional msgpack-c_7.0.2-1.dsc
 6e1e7f2cc124eace765261cbc670c989 58524 libs optional msgpack-c_7.0.2.orig.tar.xz
 3eb479f82ca519490f01e3f04a22f4a1 8112 libs optional msgpack-c_7.0.2-1.debian.tar.xz
 77b0974384dc6d779f5fdcd48f8856b8 132792 libs None msgpack-c_7.0.2-1.git.tar.xz
 f88b57120ac7f24a8565e0babf2e188b 17732 libs optional msgpack-c_7.0.2-1_source.buildinfo
Git-Tag-Info: tag=c2656ba78d516be28ba3f6e45af3fb21313e82c7 fp=91bfbf4d6956bd5df7b72d23dfe691ae331ba3db
Git-Tag-Tagger: James McCoy <jamessan@debian.org>
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEN02M5NuW6cvUwJcqYG0ITkaDwHkFAmrMM/YACgkQYG0ITkaD
wHmLMw//ZhRoN5hKOGbQ8jZIZ55NlKzBUjsEIMxS5Ws9XC8Zaa4agqZxzMGSP90t
DTkVryC6p1JSJiCxIYVycDe5WDnK8avSJQkMU/RCe/Cv8TYt7WyXweWCP2UE60hs
hHDekcNwzMbtbeWiNAIc0I2P9ld14FtlxV1bdYA6YnlZPdei4hn16QnFsuoflU/K
Cc5KaX40it8LKvP/ysXM3gLv84Fs15tbEyQHCGTZDWQal53vy38+f3HVsicq4nO6
/jUjX1OMCX6vLcs9NaZMNvL+7+2funJtg4IT7/KDHbE3RLwebiRpzisfuqirxe3Y
FNQUkXLXXOByo2fYtX7Cg2GOz+Tlup89cS2SpvuyKnfjcgjQ5k6E9QwpG8tPaELX
ksyhQFyDLRSEXEdMibeM7uV/uZpJw5FLzZVqVeYUXNKbqB8iCS38HNtfx4IhFSxU
mhM056q2dZw0QNkKjOI2Dg4xjbuS69IP82qF40QQJ+zGu0JfsYfOMTr7j8nJsHUe
NBD3QStw31bsuwPe3645muLJAr9PuLrJ52uRgM7ipM4yJU5Ea5IDBdBjD23dKCBw
prp2Jt7ERnox91gqpveKe/OeDv3fxE9Gyk+vnNCDpm1h5NGtRV7pG2eZiwu6pQPU
YhH2nw/BpSEjUbnrhanXIS54guQ4X1YNoGdUslFKo4ajchS/TGI=
=0o2G
-----END PGP SIGNATURE-----