CVE-2026-8295CWE-190

Integer overflow in simdjson

Medium · published May 14, 2026

CVSS v4.0
6.9
EPSS
0%
Percentile
37.6
In the wild
Unconfirmed
What it is

An integer overflow vulnerability in the simdjson document-builder API allows incorrect buffer size calculations in "string_builder::escape_and_append()" when processing very large input strings on platforms with limited "size_t" width (e.g., 32-bit builds). The overflow can cause insufficient buffer allocation, leading to out-of-bounds memory reads in SIMD routines and potentially resulting in information disclosure, memory corruption, or malformed JSON output.

This vulnerability has been fixed in 4.6.4 release

The record
Technical detail
CVSS v4.0
6.9 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00445 · 37.6th percentile
Weakness
CWE-190 · Integer Overflow or Wraparound
Published
2026-05-14T10:27Z
EPSS history
Timeline
  • 14 MAY 10:27Z
    Integer overflow in simdjson
    cvelistv5