CVE-2026-47235: SimulationCraft: Heap-Based Buffer Overflow / Out-of-Bounds Write in SimulationCraft's gem_id Array
SimulationCraft is a tool to explore combat mechanics in World of Warcraft. In builds after release-820-01 and before the identified May 7, 2026 nightly, the bcpapi.cpp loop over the JSON sockets array uses slotdata["sockets"].Size() without bounding gemidx by MAXGEMSLOTS, which is four in engine/scenums.hpp. The destination gemid and gembonusid arrays in engine/item/item.hpp have only four elements. More than four socket entries therefore write beyond gemid into the adjacent gembonusid vector storage; bonuslist entries can also access gembonusid out of bounds. Corrupting a vector's Mstart pointer causes the itemt destructor to free an attacker-influenced pointer during normal cleanup. The advisory reports crashes and code execution demonstrated in a testing environment. Attack inputs can arrive through a malicious .simc profile with a [[equipment]] section, a compromised addon export, or Battle.net API responses modified by an attacker with a privileged network position. The fix is contained in the nightly build identified as simc-1205-01-516b5d7; no containing release tag is available.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
SimulationCraftto a version that resolves this vulnerability.Fixed in simc-1205-01-516b5d7
Event History
Frequently Asked Questions
Which inputs can expose a SimulationCraft user to this issue?
A malicious .simc profile containing an [[equipment]] section can trigger the overflow. Inputs imported from a compromised addon export are also affected, as are Battle.net API responses altered by an attacker in a privileged network position.
What does an attacker need to include in the input?
The affected JSON sockets array must contain more than four entries. SimulationCraft supports only four gem slots, so additional entries can write past the gem_id and gem_bonus_id arrays; bonus_list entries may also access gem_bonus_id out of bounds.
What is the potential impact of successful exploitation?
The advisory reports crashes and code execution demonstrated in a testing environment. Overwriting adjacent vector storage can corrupt its _M_start pointer, causing normal item cleanup to free an attacker-influenced pointer.
Which builds are affected, and what build contains the fix?
Affected builds are after release-820-01 and before the May 7, 2026 nightly identified in the advisory. The fix is contained in nightly build simc-1205-01-516b5d7; no containing release tag is available.