CVE-2026-54522

Katalog CVE

CVSS 5.4 · Medium EPSS 0,23%

Kerentanan Use After Free pada msgpack messagepack. Skor CVSS 3.1 5.4 (Medium) menurut NVD.

Deskripsi (NVD)

MessagePack for Ruby is an implementation of the MessagePack binary serialization format. Prior to 1.8.2, MessagePack::Buffer#clear in ext/msgpack/buffer.c leaves rmem_last, rmem_end, and rmem_owner stale after _msgpack_buffer_shift_chunk returns an rmem page to the shared pool, allowing a subsequent Buffer#write and a second MessagePack::Buffer to alias the page and disclose or corrupt cross-buffer data. This issue is fixed in version 1.8.2.

Rincian

Terbit di NVD

30 Juli 2026

Terakhir diubah

5 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

5.4 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free

EPSS (30 hari)

0,23% peluang dieksploitasi; lebih tinggi dari 12,4% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-4mrv-5p47-p938 exploit · advisory vendor
• https://github.com/msgpack/msgpack-ruby/commit/5627d71606b565641d2dd501b82aae862f4abe90 patch