CVE-2026-88351

An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count, the page allocation size calculation in mpacktreeparsechildren() can overflow sizet and produce an undersized allocation. Subsequent parsing writes mpacknodedata_t records beyond the allocated heap buffer, resulting in heap-buffer-overflow, memory corruption, and denial of service.