MessagePack's LZ4 decompression may fail with AccessViolationException after dereferencing memory from bad input (CVE-2026-48109) | HOL Guard CVE