Skip to content

CVE-2026-48510

is CVE-2026-48510real, exploitable, or a false positive? Here's the community verdict.

☆ Watch
High · CVSS 7.5EPSS 0.2%CWE-409

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.301 and 3.1.7, when MessagePack-CSharp decompresses Lz4Block or Lz4BlockArray payloads, it reads declared uncompressed lengths from the wire and allocates output buffers based on those lengths before validating that the compressed data is valid or that the declared expansion is reasonable. A small payload can claim a very large uncompressed length and force a large allocation before LZ4 decoding begins. This vulnerability is fixed in 2.5.301 and 3.1.7.

References

NVD MITRE CVE.org

Published

Embed this verdict
TruePositive verdict for CVE-2026-48510
Markdown
[![TruePositive verdict](https://www.truepositive.app/cve/CVE-2026-48510/badge.svg)](https://www.truepositive.app/cve/CVE-2026-48510)
HTML
<a href="https://www.truepositive.app/cve/CVE-2026-48510"><img src="https://www.truepositive.app/cve/CVE-2026-48510/badge.svg" alt="TruePositive verdict for CVE-2026-48510"></a>

Live badge that updates automatically as the community verdict changes.

Community ground truth

In your experience, is this finding real and exploitable?

0 verdicts
Not a real issue

No account needed. Anonymous verdicts post as an unverified signal. Log in to make yours verified and earn reputation.

Field notes & remediation

Verdicts are the quick signal. Notes are the evidence and fixes behind them.

No notes yet. Be the first to share what you saw, or a fix that worked.

    Add a field note or remediationoptional
    Note type

    What are you adding?

    Markdown supported · minimum 20 characters.

    Related CVEs

    Same weakness: CWE-409.