CVE-2026-32284 describes a high-severity (CVSS 7.5) denial-of-service vulnerability in the msgpack decoder. Improper input buffer length validation for truncated fixext data can lead to an out-of-bounds read and runtime panic. This flaw is remotely exploitable with low attack complexity and no user interaction, impacting system availability. While specific affected products are not detailed in the provided data, the issue impacts systems utilizing the vulnerable msgpack decoder. There is currently no evidence of active exploitation, no public exploit code available, and minimal community attention beyond a SUSE security update.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 3.1.2CPE matchmatch criteria | cpe:2.3:a:shamaton:msgpack:*:*:*:*:*:go:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.