Vulnerability · Published May 14, 2026 · Assigned by CERT-PL

CVE-2026-8295Integer overflow in simdjson

Medium 6.9

In plain English

A medium-severity integer overflow in simdjson from simdjson. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 20% of all known vulnerabilities).

Severity (CVSS 4.0)6.9Medium

Exploit odds (30 days)0.3%top 79.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An integer overflow vulnerability in the simdjson document-builder API allows incorrect buffer size calculations in "string_builder::escape_and_append()" when processing very large input strings on platforms with limited "size_t" width (e.g., 32-bit builds). The overflow can cause insufficient buffer allocation, leading to out-of-bounds memory reads in SIMD routines and potentially resulting in information disclosure, memory corruption, or malformed JSON output. This vulnerability has been fixed in 4.6.4 release

Affected products (as reported)

Vendor	Product	Versions
simdjson	simdjson	0 – before 4.6.4

Weakness: CWE-190 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

References

https://github.com/simdjson/simdjson/releases/tag/v4.6.4 release-notes
https://cert.pl/posts/2026/05/CVE-2026-8295 third-party-advisory