Tencent RapidJSON CVE-2026-116620

Exploitation requires the embedding application to pass attacker-influenced data through RapidJSON's Regex Parser path (its schema/regex validation feature), which reaches the vulnerable GenericStringStream::Take in include/rapidjson/stream.h; applications that never use the regex/schema functionality are not exposed. The CVSS vector (AV:N/AC:L/PR:N/UI:N) implies no authentication or user interaction once that code path is reachable, but because RapidJSON is a header-only library, actual remote reachability depends on how the host application exposes JSON/regex parsing to untrusted input. Impact is limited to a partial out-of-bounds read (information disclosure of adjacent memory and/or crash), not code execution. Affected versions are RapidJSON 1.0 and 1.1.0 (up to 1.1.0); no fixed release has been published by the project.

This is a moderate-severity out-of-bounds read (CWE-125) in Tencent RapidJSON's GenericStringStream::Take, reached through the library's Regex Parser component. Signals are consistent and point to a real-but-not-urgent issue rather than a top-priority emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) describes a low-complexity, unauthenticated, remotely reachable flaw, but the impact is capped at partial (VC:L/VI:L/VA:L), yielding only 5.5. EPSS is low at 0.30% (23rd percentile) and the vuln.today decision label is 'this_month', not 'act_now' or 'emergency'. SSVC records Exploitation=poc, Automatable=yes, Technical Impact=partial. There is no CISA KEV listing, so there is no evidence of active exploitation. A public PoC reference exists (the GitHub issue report) but it is not verified as working exploit code, so POC availability must not be read as confirmed exploitability. A notable caveat: 'remotely reachable' depends entirely on whether the embedding application feeds attacker-controlled input through RapidJSON's regex/schema path - RapidJSON is a header-only library, so the true attack surface is application-dependent and cannot be confirmed from this data. The CVSS VI:L (integrity) assignment is also questionable for a pure out-of-bounds read, which typically affects confidentiality and availability, not integrity - verify with the vendor.

An application that uses RapidJSON's schema/regex validation processes attacker-supplied input, and a crafted string drives GenericStringStream::Take past the end of the buffer, causing an out-of-bounds read. Because AC:L/PR:N/UI:N, no authentication or user interaction is required once the vulnerable code path is reachable, and the attacker may be able to leak adjacent memory contents or crash the process. A public PoC reference exists in the project's issue tracker, but it is not verified as working exploit code.