Threats tagged 'ghsa-j4vg-phqw-mpqx'

Tencent RapidJSON version 1.1.0 contains a vulnerability in the GetCachedPowerByIndex function within include/rapidjson/internal/diyfp.h. The flaw involves manipulation of the decimalPosition argument, leading to an out-of-bounds read. This vulnerability can be exploited remotely without authentication. Public exploit code has been disclosed. The project has been notified but has not yet issued a response or patch.