DEV Community

CVE Reports
CVE Reports

Posted on • Originally published at cvereports.com

CVE-2026-54522: CVE-2026-54522: Same-Process Use-After-Free and Cross-Buffer Data Disclosure in msgpack-ruby

#security #cve #cybersecurity

CVE-2026-54522: Same-Process Use-After-Free and Cross-Buffer Data Disclosure in msgpack-ruby

Vulnerability ID: CVE-2026-54522
CVSS Score: 2.1
Published: 2026-07-30

A Use-After-Free (UAF) vulnerability exists in msgpack-ruby prior to version 1.8.2. The MessagePack::Buffer#clear method returns the associated 4 KiB rmem page to the shared pool but fails to reset the buffer's tracking pointers (rmem_last, rmem_end, and rmem_owner). Subsequent write operations on the cleared buffer can alias the freed page, allowing concurrent buffers to access, disclose, or corrupt cross-buffer data. This issue is resolved in version 1.8.2.

TL;DR

A Use-After-Free in msgpack-ruby < 1.8.2 allows cross-buffer memory aliasing, resulting in same-process information disclosure and stream corruption when buffers are cleared and reused.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-416 (Use After Free)
  • Attack Vector: Local (AV:L)
  • CVSS v4.0 Score: 2.1 (Low)
  • Exploit Status: Proof-of-Concept Available
  • Impact: Information Disclosure / Stream Corruption
  • KEV Status: Not Listed

Affected Systems

  • Ruby applications utilizing the msgpack-ruby gem with persistent or pooled MessagePack::Buffer instances.
  • msgpack-ruby: < 1.8.2 (Fixed in: 1.8.2)

Code Analysis

Commit: 5627d71

Reset rmem cursors in _msgpack_buffer_shift_chunk when the head buffer becomes empty, preventing Use-After-Free in subsequent writes.

diff --git a/ext/msgpack/buffer.c b/ext/msgpack/buffer.c
index d1583702..f6a037ff 100644
--- a/ext/msgpack/buffer.c
+++ b/ext/msgpack/buffer.c
@@ -134,6 +134,9 @@ bool _msgpack_buffer_shift_chunk(msgpack_buffer_t* b)
          * because head should be always available */
         b->tail_buffer_end = NULL;
         b->read_buffer = NULL;
+        b->rmem_end = NULL;
+        b->rmem_last = NULL;
+        b->rmem_owner = NULL;
         return false;
     }
Enter fullscreen mode Exit fullscreen mode

Exploit Details

  • GitHub Security Advisory: Includes a complete proof-of-concept demonstrating same-process use-after-free and cross-buffer disclosure via msgpack-ruby.

Mitigation Strategies

  • Upgrade the msgpack dependency to version 1.8.2 or later.
  • Refactor applications to instantiate a new MessagePack::Buffer for every serialization task instead of reusing and clearing a persistent buffer.
  • Conduct static analysis scanning of dependency trees to identify and flag older versions of the msgpack gem.

Remediation Steps:

  1. Open the application's Gemfile and locate the msgpack dependency declaration.
  2. Update the entry to require version 1.8.2 or higher: gem 'msgpack', '>= 1.8.2'
  3. Execute the package manager command to update the dependency: bundle update msgpack
  4. Deploy the updated dependency configuration to testing and production environments.

References

Read the full report for CVE-2026-54522 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)