CVE-2026-8295 Details
Description
An integer overflow vulnerability in the simdjson document-builder API allows incorrect buffer size calculations in "string_builder::escape_and_append()" when processing very large input strings on platforms with limited "size_t" width (e.g., 32-bit builds). The overflow can cause insufficient buffer allocation, leading to out-of-bounds memory reads in SIMD routines and potentially resulting in information disclosure, memory corruption, or malformed JSON output. This vulnerability has been fixed in 4.6.4 release
A vulnerability allowing integer overflow has been identified in the simdjson library, specifically within the document-builder API. This issue arises in versions prior to 4.6.4 and affects platforms with limited 'size_t' width, such as 32-bit builds. The vulnerability occurs in the 'string_builder::escape_and_append()' function, where very large input strings can lead to incorrect buffer size calculations. The resulting overflow may cause insufficient buffer allocation, allowing out-of-bounds memory reads in SIMD routines. This could lead to information disclosure, memory corruption, or the generation of malformed JSON output.
Users can upgrade to simdjson version 4.6.4 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed May 14, 2026CISA-ADP
Assessed May 14, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://cert.pl/posts/2026/05/CVE-2026-8295 | [email protected] | AdvisoryRemedy |
| https://github.com/simdjson/simdjson/releases/tag/v4.6.4 | [email protected] | Release NotesVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-190 | Integer Overflow or Wraparound | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| simdjson | < 4.6.4 (semver) |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| May 14, 2026 | New CVE Received | [email protected] |