BaselineWatch
Desk
Your fleet and your work Fleetyour releases and the hardware they run onTriagewhat needs a decisionWatchlistthe products and platforms you runSaved searchesthe lists you come back to
This instance Sourceswhat is read, how often, under what termsDigestthe daily or weekly summary, and alerts
How it is drawn Appearancethe look and the colour schemeBrandingthe mark this instance wears
Owner sign-in

CVE-2026-92707

5.3 medium publicly disclosed SSVC exploitation: none Awaiting Analysis
NVD · CVE.org

MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormatter can cause excessive memory allocation. The formatter allocates an object[] from each declared array length before the configured object-graph depth limit rejects the input, while nested array headers can reuse the same trailing unread bytes to satisfy per-header length validation. A comparatively small payload can therefore keep many large arrays alive at once. When an attacker can submit such data repeatedly, the allocations can cause severe managed-heap pressure, excessive garbage collection, process termination, or loss of service. Exposure requires an application to deserialize untrusted data through the affected formatter path and permit repeated attacker-controlled submissions, such as a reachable ASP.NET Core SignalR hub method with an object parameter and AddMessagePackProtocol() enabled. This issue is fixed in versions 2.5.303 and 3.1.9.

Fix

Microsoft's update · Moderate · publicly disclosed

  • Release Notes — Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 10.0 runtime installed on Windows, Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 10.0 runtime installed on Linux, Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 10.0 runtime installed on Mac OS · build 10.0.13
  • Release Notes — Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 11.0 runtime installed on Windows, Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 11.0 runtime installed on Linux, Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 11.0 runtime installed on Mac OS · build 11.0.0-rc.2
  • Release Notes — Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 8.0 runtime installed on Windows, Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 8.0 runtime installed on Linux, Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 8.0 runtime installed on Mac OS · build 8.0.32
  • Release Notes — Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 9.0 runtime installed on Windows, Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 9.0 runtime installed on Linux, Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 9.0 runtime installed on Mac OS · build 9.0.21
  • Release Notes — Microsoft Visual Studio 2026 version 18.10 · build 18.10.4 · restart required
  • Release Notes — Microsoft Visual Studio 2022 version 17.14 · build 17.14.42 · restart required
  • Release Notes — MessagePack 2.5.303 · build 2.5.303
  • Release Notes — MessagePack 3.1.9 · build 3.1.9

From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-28 · Exploitation Less Likely.

Vendor advisories in the News 1

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

Change history 2

  1. StatusReceived → Awaiting AnalysisNVD modified 2026-10-16 16:00
  2. First seenCVSS 5.3NVD modified 2026-10-15 19:17

Affected (CPE criteria) 0

NVD has not attached CPE configurations yet.

References 5