CVE-2026-8295: Integer overflow in simdjson
An integer overflow vulnerability in the simdjson document-builder API allows incorrect buffer size calculations in "stringbuilder::escapeandappend()" when processing very large input strings on platforms with limited "sizet" width (e.g., 32-bit builds). The overflow can cause insufficient buffer allocation, leading to out-of-bounds memory reads in SIMD routines and potentially resulting in information disclosure, memory corruption, or malformed JSON output. This vulnerability has been fixed in 4.6.4 release
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
simdjsonto a version that resolves this vulnerability.Fixed in 4.6.4
Event History
Frequently Asked Questions
What is the severity of CVE-2026-8295?
CVE-2026-8295 is classified as a moderate severity vulnerability due to potential buffer overflow risks.
How do I fix CVE-2026-8295?
To fix CVE-2026-8295, upgrade to simdjson version 4.6.4 or later.
What software is affected by CVE-2026-8295?
CVE-2026-8295 affects simdjson versions prior to 4.6.4 on platforms with limited 'size_t' width.
What causes CVE-2026-8295?
CVE-2026-8295 is caused by an integer overflow in the string_builder::escape_and_append() function during large string processing.
Is CVE-2026-8295 a critical vulnerability?
No, CVE-2026-8295 is considered moderate, but it can lead to application instability if exploited.