EOL Fix Available | CVE-2026-48109

Overview

MessagePack-CSharp is a high-performance MessagePack serializer for C# and .NET. HeroDevs NES Essentials Plus maintains a MessagePack-CSharp fork for post-EOL .NET environments that need backported security fixes while staying on the NES package line.

An out-of-bounds read vulnerability (CVE-2026-48109) has been identified in MessagePack-CSharp, which allows attackers to read past the end of the compressed input buffer when LZ4 compression is enabled. The decoder used by the Lz4Block and Lz4BlockArray compression modes is based on a deprecated fast-decompression algorithm that takes no source-length bound, so crafted LZ4 token and length fields can drive reads beyond the supplied payload. In affected environments this raises an AccessViolationException during decompression and terminates the process, resulting in Denial of Service; under some conditions, limited unintended memory disclosure from the over-read data may also be possible before the failure.

Per CWE-20: Improper Input Validation, Improper Input Validation is defined as a product that receives input or data, but does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

This issue affects multiple versions of MessagePack-CSharp, including all v2 releases before 2.5.301 and v3 releases from 3.0.214-rc.1 before 3.1.7, in applications that deserialize untrusted payloads with LZ4 compression enabled. The HeroDevs NES Essentials Plus MessagePack fork is affected in the 2.5.192.x line before 2.5.192.2.

‍

Details

Module Info

Product: MessagePack-CSharp (the MessagePack NuGet serializer for .NET, also compiled into and referenced by ASP.NET Core SignalR and Blazor Server)
Affected packages: MessagePack
Affected versions:
- MessagePack < 2.5.301
- MessagePack >= 3.0.214-rc.1 < 3.1.7
- NES Essentials Plus MessagePack 2.5.192.x before 2.5.192.2
GitHub repository: https://github.com/MessagePack-CSharp/MessagePack-CSharp
Published packages: https://www.nuget.org/packages/MessagePack
Package manager: NuGet
Fixed in: NES Essentials Plus MessagePack 2.5.192.2 (first published as 2.5.192.3)

Vulnerability Info

This High-severity vulnerability is found in the MessagePack package in the LZ4 decompression path of MessagePack-CSharp. When a payload is serialized with MessagePackCompression.Lz4Block or MessagePackCompression.Lz4BlockArray, the read side hands the compressed block to a bundled LZ4 decoder built on the deprecated fast-decompression entry point, which trusts the block to be well-formed and accepts no bound on how far it may read from the source buffer. The decoder walks the LZ4 token stream, using each token's literal length and match offset to copy from the input, and because those fields are attacker-controlled and never checked against the remaining source length, a crafted payload can drive the read cursor past the end of the compressed buffer.

A remote or otherwise untrusted producer whose data reaches a deserializer with LZ4 compression enabled can therefore force reads from unmapped memory, raising an AccessViolationException that cannot be handled and terminating the process. Where the over-read lands on mapped memory instead, the copied bytes are written into the decompressed output, so limited unintended disclosure of adjacent process memory may be possible before decoding fails. Applications that do not enable LZ4 compression are not exposed to this particular decode path.

This vulnerability has been present since at least MessagePack 2.0 and likely earlier.

‍

Mitigation

.NET 6 is End-of-Life and will not receive any updates to address this issue. For more information see .NET and .NET Core official support policy.

Users of the affected components should apply one of the following mitigations:

Upgrade affected applications to one of:
- MessagePack >= 2.5.301
- MessagePack >= 3.1.7
Leverage a commercial support partner like HeroDevs for post-EOL security support, including NES Essentials Plus MessagePack 2.5.192.2 or later (first published as 2.5.192.3).

‍