simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parseunpadded(). A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause jsoniterator::walkdocument() to access buf[len] after the input buffer has been exhausted. This results in a heap out-of-bounds read and may cause application termination, leading to denial of service.

An integer overflow vulnerability in the simdjson document-builder API allows incorrect buffer size calculations in "stringbuilder::escapeandappend()" when processing very large input strings on platforms with limited "sizet" width (e.g., 32-bit builds). The overflow can cause insufficient buffer allocation, leading to out-of-bounds memory reads in SIMD routines and potentially resulting in information disclosure, memory corruption, or malformed JSON output. This vulnerability has been fixed in 4.6.4 release