EUVD-2026-38385

MessagePack for C is a MessagePack serializer for C. Prior to 2.5.301 and 3.1.7, ExpandoObjectFormatter.Deserialize populates System.Dynamic.ExpandoObject by calling IDictionary.Add for each map entry. ExpandoObject internally maintains member names in array-like structures, so inserting many...

PT-2025-20957 · Microsoft · Urlmon +1

Name of the Vulnerable Software and Affected Versions: UrlMon affected versions not specified Description: The issue allows an unauthorized attacker to bypass a security feature over a network by accepting extraneous untrusted data with trusted data in UrlMon. This enables attackers to affect the...

CVE-2022-27158

pearweb 1.32 suffers from Deserialization of Untrusted Data...