CVE-2026-88358: n/a
simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded(). A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause json_iterator::walk_document() to access buf[len] after the input buffer has been exhausted. This results in a heap out-of-bounds read and may cause application termination, leading to denial of service.
AI Analysis
Technical Summary
CVE-2026-88358 describes a heap out-of-bounds read vulnerability in simdjson 4.6.1. The issue arises in dom::parser::parse_unpadded() when processing a truncated JSON document whose final structural token closes a nested array or object. This triggers json_iterator::walk_document() to access memory beyond the buffer boundary (buf[len]), resulting in a one-byte out-of-bounds read. The vulnerability may cause the affected application to terminate unexpectedly, resulting in denial of service.
Potential Impact
The vulnerability can cause a heap out-of-bounds read leading to application termination. This results in a denial of service condition. There is no indication of code execution or data corruption beyond the out-of-bounds read and application crash.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or truncated JSON documents that could trigger this condition.
CVE-2026-88358: n/a
Description
simdjson 4.6.1 contains a one-byte out-of-bounds read vulnerability in dom::parser::parse_unpadded(). A specially crafted truncated JSON document whose final structural token closes a nested array or object can cause json_iterator::walk_document() to access buf[len] after the input buffer has been exhausted. This results in a heap out-of-bounds read and may cause application termination, leading to denial of service.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-88358 describes a heap out-of-bounds read vulnerability in simdjson 4.6.1. The issue arises in dom::parser::parse_unpadded() when processing a truncated JSON document whose final structural token closes a nested array or object. This triggers json_iterator::walk_document() to access memory beyond the buffer boundary (buf[len]), resulting in a one-byte out-of-bounds read. The vulnerability may cause the affected application to terminate unexpectedly, resulting in denial of service.
Potential Impact
The vulnerability can cause a heap out-of-bounds read leading to application termination. This results in a denial of service condition. There is no indication of code execution or data corruption beyond the out-of-bounds read and application crash.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid processing untrusted or truncated JSON documents that could trigger this condition.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- mitre
- Date Reserved
- 2026-09-10T00:00:00.000Z
- State
- PUBLISHED
Threat ID: 6ab54645f7a7c541067fcbb2
Added to database: 09/24/2026, 15:48:21 UTC
Last enriched: 09/24/2026, 16:03:19 UTC
Last updated: 09/25/2026, 01:56:00 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.