CVE-2026-88358 in simdjson
Summary
by MITRE • 09/24/2026
simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded(). A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause json_iterator::walk_document() to access buf[len] after the input buffer has been exhausted. This results in a heap out-of-bounds read and may cause application termination, leading to denial of service.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/24/2026
The simdjson library version 4.6.1 is susceptible to a critical memory safety vulnerability classified as an out-of-bounds read within the JSON parsing engine. Specifically, the flaw resides in the dom::parser::parse_unpadded() function and its interaction with json_iterator::walk_document(). This issue manifests when processing specially crafted input documents that are truncated or malformed such that their final structural token serves to close a nested array or object structure. The vulnerability arises from an off-by-one error where the parser logic fails to properly validate buffer boundaries before accessing memory, leading to a heap out-of-bounds read condition.
From a technical perspective, the root cause lies in how the iterator handles end-of-file conditions for complex nested structures. When walk_document() processes the closing token of a deeply nested element at the very end of an input stream that has been truncated or ends abruptly, it attempts to access buf[len]. In standard C++ memory models, accessing index len on a buffer of length len is invalid because valid indices range from zero to len minus one. This specific boundary check failure allows the application to read one byte beyond the allocated heap memory region associated with the input buffer. While this does not constitute an arbitrary code execution vector due to its read-only nature, it represents a significant stability risk for any software relying on simdjson for high-performance JSON processing.
The operational impact of this vulnerability is primarily centered around availability and system stability rather than confidentiality or integrity in most contexts. Because the flaw results in reading uninitialized or out-of-bounds memory, the immediate consequence is typically an application crash or termination. This leads to a denial of service condition where services that depend on continuous JSON parsing capabilities become unavailable until restarted. In environments where simdjson is used for high-throughput API gateways, log analyzers, or real-time data ingestion pipelines, such crashes can cause significant downtime and disrupt downstream processes. Although the primary impact is DoS, in rare scenarios involving sensitive memory layouts, out-of-bounds reads could potentially leak small amounts of adjacent heap metadata or stack information, though this requires specific exploitation conditions not guaranteed by the default behavior.
This vulnerability aligns with CWE-125, which defines Out-of-Bounds Read, and maps to MITRE ATT&CK technique T1083, File and Directory Discovery, if used for reconnaissance, but more accurately reflects T1499 Endpoint Denial of Service when leveraged by an attacker. The lack of proper boundary validation in the parsing logic highlights a common class of errors in high-performance C++ libraries where manual memory management is prevalent. Developers integrating simdjson must recognize that even read-only vulnerabilities can destabilize production systems, particularly under load or when processing untrusted input from external sources.
Mitigation strategies should focus on immediate patching and defensive coding practices. The most effective remediation is to upgrade the simdjson dependency to a version later than 4.6.1 where this boundary check has been corrected by the maintainers. For organizations unable to update immediately, implementing strict input validation at the application layer can help mitigate risk. This includes validating JSON document integrity before passing it to the parser and ensuring that truncated or incomplete documents are handled gracefully without invoking the vulnerable parsing path if possible. Additionally, deploying runtime protection mechanisms such as Address Sanitizer in testing environments and Heap Protection features like ASLR and DEP in production can reduce the likelihood of successful exploitation and aid in detecting similar issues during development cycles. Regular security audits focusing on memory safety in C++ components are recommended to prevent recurrence of such boundary-related flaws.