PT-2026-66528 · Rubygems · Messagepack For Ruby

CVE-2026-54522 · Published 2026-07-30 · Updated 2026-07-30

Positive Technologies (AI Summary)

CVSS v4.0

2.1

Low

Base vector

AV:L/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions MessagePack for Ruby versions prior to 1.8.2

Description A use-after-free issue exists in the MessagePack::Buffer#clear function within ext/msgpack/buffer.c. When this function is called, it returns memory pages to a shared pool but fails to reset the buffer's rmem cursor variables rmem last, rmem end, and rmem owner. Consequently, a subsequent call to Buffer#write may reuse a pointer to a page that has already been returned to the pool. If a second MessagePack::Buffer acquires that same page, both buffers will alias the same memory location. This can lead to cross-buffer information disclosure, where one buffer reads data belonging to another, or data corruption, where one buffer overwrites the other's serialized data.

Recommendations Update MessagePack for Ruby to version 1.8.2 or later.

Exploit

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2026-54522

GHSA-4MRV-5P47-P938

Affected Products

Messagepack For Ruby

References · 7

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/msgpack/CVE-2026-54522.yml · Exploit
• 🔥 https://github.com/msgpack/msgpack-ruby/security/advisories/GHSA-4mrv-5p47-p938 · Exploit
• https://cve.org/CVERecord/SearchResults?query=CVE-2026-54522 · Security Note
• https://osv.dev/vulnerability/GHSA-4mrv-5p47-p938 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-54522 · Security Note
• https://github.com/msgpack/msgpack-ruby · Note
• https://github.com/msgpack/msgpack-ruby/commit/5627d71606b565641d2dd501b82aae862f4abe90 · Note