CVE-2026-92707: MessagePack-CSharp Denial of Service Vulnerability
Improperly controlled sequential memory allocation in .NET allows an unauthorized attacker to deny service over a network.
- Published by source
- 2026-10-13
- First seen by Reality Radar
- 2026-10-22
- Last verified
- 2026-10-22
Affected
- Manufacturer
- Microsoft
- Products
- System.Formats.Cbor on .NET 10.0 installed on Windows System.Formats.Cbor on .NET 10.0 installed on Linux System.Formats.Cbor on .NET 10.0 installed on Mac OS Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 11.0 installed on Windows Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 11.0 installed on Linux Microsoft.AspNetCore.SignalR.Protocols.MessagePack on .NET 11.0 installed on Mac OS System.Formats.Cbor on .NET 8.0 installed on Windows System.Formats.Cbor on .NET 8.0 installed on Linux System.Formats.Cbor on .NET 8.0 installed on Mac OS System.Formats.Cbor on .NET 9.0 installed on Windows System.Formats.Cbor on .NET 9.0 installed on Linux System.Formats.Cbor on .NET 9.0 installed on Mac OS Microsoft Visual Studio 2026 version 18.10 Microsoft Visual Studio 2022 version 17.14 Microsoft Edge (Chromium-based)
- CPE
- cpe:2.3:a:microsoft:system.formats.cbor:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:microsoft.aspnetcore.signalr.protocols.messagepack:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:microsoft_visual_studio_2026_version_18.10:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:visual_studio_2022:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:microsoft_edge_chromium-based:*:*:*:*:*:*:*:*
Whether your exact unit is affected depends on the model, serial number and region in the official notice.
What the official notice says
Risk: Moderate
Remedy / actions:
- Install the latest Microsoft security update
Is this affecting you?
Add what you own or use and Reality Radar will tell you when official changes match it — with evidence and next steps.
Sources
- Microsoft Security Update Guide (MSRC) Tier A · official published 2026-10-13
Evidence ledger
Every piece of evidence we store is appended to a public hash chain, so later edits are detectable. Anyone can re-verify it.
| Entry | Kind | Observed | Evidence hash | Entry hash |
|---|---|---|---|---|
| #163 | new | 2026-10-22 | 63d565334fd5…be6c12 | 8e8ad92d7555…e3c060 |
Chain head: #1076 8ad5adc30b9b…88ce20