CVE-2026-88350

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-88350
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88350.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-88350
Downstream
Published
2026-09-22T00:00:00Z
Modified
2026-09-24T08:34:22Z
Summary
[none]
Details

An integer overflow vulnerability exists in MPack 1.1.1 in mpack_node_cstr_alloc() and mpack_node_utf8_cstr_alloc().

Database specific 
{
    "cna_assigner":  "mitre",
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/88xxx/CVE-2026-88350.json"
}
References

Affected packages

Git / github.com/ludocode/mpack

Affected ranges

Type
GIT
Repo
https://github.com/ludocode/mpack
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
3d54d1215bdb5478d3ddecaf85884c58b382cd9b
Database specific
Show details 
{
    "source":  "REFERENCES"
}

Affected versions

v0.*
v0.1
v0.2
v0.3
v0.4
v0.5
v0.5.1
v0.6
v0.7
v0.7.1
v0.8
v1.*
v1.0
v1.1
v1.1.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-88350.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "134114985431313568475531725662640486633",
                "326475896255593249226536623334792904617",
                "195636019037067069974526492084522433520",
                "7647291496607415104410392393196425664",
                "161329359478950106121882062351349499136",
                "148438582230550467453999891100961925772",
                "172951168611092304810127879482882296982",
                "59282909036903436543694203090053868507",
                "104959432097220956514102992630977654461",
                "310703410902621982056484493920939568988",
                "68359362286314421379550633674140460660",
                "220818935085839064775305871753125067324",
                "278303503470838405726977075912863604162",
                "206477317074911773193808818670590599373"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88350-02d93c8c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b",
        "target":  {
            "file":  "src/mpack/mpack-platform.h"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "206546651593704512819201060802903525632",
                "92274785185808419563324714325453680440",
                "337789682991149085389275308949126705406",
                "266059725220556995011136956146555004204"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88350-2410434c",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b",
        "target":  {
            "file":  "src/mpack/mpack-reader.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "21709165583436065598785712405074811667",
            "length":  507
        },
        "id":  "CVE-2026-88350-3a0c8f11",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b",
        "target":  {
            "file":  "src/mpack/mpack-node.c",
            "function":  "mpack_tree_reserve_bytes"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "202098248838091100635918738264013372723",
            "length":  578
        },
        "id":  "CVE-2026-88350-56726bce",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b",
        "target":  {
            "file":  "src/mpack/mpack-reader.c",
            "function":  "mpack_read_bytes_alloc_impl"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "211273342386618531264627726310780638168",
            "length":  854
        },
        "id":  "CVE-2026-88350-5b48e8ad",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b",
        "target":  {
            "file":  "src/mpack/mpack-node.c",
            "function":  "mpack_node_cstr_alloc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "211273342386618531264627726310780638168",
            "length":  854
        },
        "id":  "CVE-2026-88350-62a26c23",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b",
        "target":  {
            "file":  "src/mpack/mpack-node.c",
            "function":  "mpack_node_utf8_cstr_alloc"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "336467402232554008006095521988324552709",
                "98147249126477827410188671532614969719",
                "47986807282682011949487265560486412299",
                "225900805345574462693218222296053309108",
                "217979798596659606024510427840962776443",
                "32431311063107430533214628165014513749",
                "288300643188516365557321143997166614329",
                "235608423939302046198294751261338698489",
                "114986593260555629666746564088702130747",
                "77835347133786540433124161091397482965",
                "314487407362405077064157177147255584043",
                "204946828916679119100435267081151522160",
                "153029592123302311435580500984486563524",
                "276924999144375692851068177412395640250",
                "2038572795316649061027920051338300128",
                "318582466350697282357646762701666453512",
                "172868765786967298101388718028823545562",
                "429357351862965631037666989651017568",
                "136330617788040211009001627890025310030",
                "279745756761454532046586821843124597629",
                "242402823214316651457850817053352356064",
                "203056113437415105473740319634177661142",
                "196919776399781612808252215425236076987",
                "201043746515437138179941118733334847516",
                "117429183846590683013676250351001748532",
                "19424957821787546425203878492380901367",
                "318038032657886262469628779661031368895",
                "111125997405712485795845841000398424697",
                "85119225527511782115614405903583304951",
                "268629568360586192827340494950851544064",
                "303659436335047846079390582388809723410",
                "326400538913878746555207552360420422512",
                "219270325235822676889796459913933941696",
                "240082686626574144678563664481548234380",
                "339568951502023328656572706595419429625",
                "327626749469177226008848329847372342648",
                "328582550280512913474833248299881647604",
                "170234490051347231795437596880127564200",
                "73851040281652141782493381473361993292",
                "185786833281451760895852134623009535897",
                "219270325235822676889796459913933941696",
                "240082686626574144678563664481548234380",
                "339568951502023328656572706595419429625",
                "327626749469177226008848329847372342648",
                "328582550280512913474833248299881647604",
                "170234490051347231795437596880127564200",
                "73851040281652141782493381473361993292",
                "185786833281451760895852134623009535897"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88350-7adce31e",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b",
        "target":  {
            "file":  "src/mpack/mpack-node.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "183993625131744956039804621295526464970",
            "length":  1185
        },
        "id":  "CVE-2026-88350-7d336611",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b",
        "target":  {
            "file":  "src/mpack/mpack-writer.c",
            "function":  "mpack_growable_writer_flush"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "55644624274819820945587898720498436000",
            "length":  1922
        },
        "id":  "CVE-2026-88350-996337a4",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b",
        "target":  {
            "file":  "src/mpack/mpack-node.c",
            "function":  "mpack_tree_parse_children"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "67938714778323247099291424490566486837",
            "length":  1882
        },
        "id":  "CVE-2026-88350-bfb6350b",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b",
        "target":  {
            "file":  "src/mpack/mpack-node.c",
            "function":  "mpack_tree_reserve_fill"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "92181309082125494625966943361966667685",
                "308303128621561714552536526046939983488",
                "269247216766000980178684944988870531830",
                "73942333486967406668885420734784837811",
                "100055841584776475880693629605528409476",
                "147349125951277310989280158645712989426",
                "245457086971826548020508589208868121854",
                "19003798717799923704607512326718914851",
                "253431897713949885653285931192316191503",
                "199494567900746542844299831532195444358",
                "305623364183490821511173700216602033416",
                "214650788507505408146384322850950080051"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-88350-c0d7c8bc",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/ludocode/mpack/commit/3d54d1215bdb5478d3ddecaf85884c58b382cd9b",
        "target":  {
            "file":  "src/mpack/mpack-writer.c"
        }
    }
]
vanir_signatures_modified 
"2026-09-24T08:34:22Z"