CVE-2026-54522

MessagePack for Ruby (the msgpack-ruby gem) prior to version 1.8.2 contains a stale-pointer flaw (CWE-416) in MessagePack::Buffer#clear: when the C extension returns an internal read-memory (rmem) page to the shared pool via _msgpack_buffer_shift_chunk, the rmem_last, rmem_end, and rmem_owner fields are left pointing at the freed page. A subsequent Buffer#write on the cleared buffer, combined with a second MessagePack::Buffer in the same process allocating that recycled page, causes both buffers to alias the same memory. An attacker with local access or the ability to influence serialized data in such a process can read or corrupt data belonging to the other buffer; the CVSS 4.0 score of 2.1 assesses the impact as low-severity information disclosure with a local attack vector. Any Ruby application using MessagePack serialization (commonly for caching, RPC, or message handling) on versions before 1.8.2 is affected, but triggering requires a specific clear-then-reuse buffer pattern. No in-the-wild exploitation is known: the flaw is not in CISA KEV, EPSS estimates a 0.2% probability of exploitation within 30 days, and the only public reference is the GitHub advisory GHSA-4mrv-5p47-p938.

What to do: Upgrade msgpack-ruby to version 1.8.2 or later. As an interim mitigation, avoid calling MessagePack::Buffer#clear on buffers that are subsequently reused (allocate fresh buffers instead) and audit code paths that clear and reuse MessagePack buffers within a single process. Given the local attack vector, prioritize hosts that run untrusted local code or multi-tenant Ruby processes.