CVE-2026-8295 — Integer overflow in simdjson

Description (CNA)

An integer overflow vulnerability in the simdjson document-builder API allows incorrect buffer size calculations in "string_builder::escape_and_append()" when processing very large input strings on platforms with limited "size_t" width (e.g., 32-bit builds). The overflow can cause insufficient buffer allocation, leading to out-of-bounds memory reads in SIMD routines and potentially resulting in information disclosure, memory corruption, or malformed JSON output. This vulnerability has been fixed in 4.6.4 release

Affected (CNA)

Vendor / product	Versions
simdjson / simdjson	affected 0 before 4.6.4

CWE

CWE-190

References

https://github.com/simdjson/simdjson/releases/tag/v4.6.4
https://cert.pl/posts/2026/05/CVE-2026-8295

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.