CVE-2026-54522

CVE-2026-54522 affects MessagePack for Ruby prior to 1.8.2, where MessagePack::Buffer#clear can leave internal rmem pointers stale after a chunk return, enabling a subsequent Buffer#write to alias the freed page and potentially disclose or corrupt cross-buffer data. Root cause: stale rmem_last/rm...