Executive brief
simdjson is a high-performance library used by many applications to parse and process JSON data. A vulnerability in its document-building component could allow an attacker to provide specially crafted, large input strings that cause the software to miscalculate memory requirements. This can lead to application crashes, memory corruption, or the unintended disclosure of sensitive information from the system's memory.
Technical details
An integer overflow vulnerability exists in the 'string_builder::escape_and_append()' function within the simdjson document-builder API. The flaw occurs when processing extremely large input strings on platforms where 'size_t' has limited width, such as 32-bit architectures. This overflow leads to an undersized buffer allocation; subsequent SIMD-accelerated operations may then perform out-of-bounds memory reads. An attacker can exploit this to cause memory corruption, information disclosure, or produce malformed JSON output. The issue is addressed in version 4.6.4.
Affected products
- simdjson simdjson < 4.6.4
Timeline
- 2026-05-06: patched: Version 4.6.4 released on GitHub
- 2026-05-14: disclosed: Initial disclosure by CERT.PL
- 2026-05-14: advisory: NVD publication date