simdjson CVE-2026-8295

simdjson is a high-performance JSON parsing library that uses SIMD (Single Instruction Multiple Data) operations to accelerate document parsing. The vulnerability exists in the document-builder API's string_builder::escape_and_append() function, which calculates buffer sizes for escaped string output. On 32-bit systems where size_t has limited width (typically 32 bits), processing very large input strings can cause integer overflow during buffer size calculation (CWE-190). This results in an undersized buffer allocation, which is then exceeded by SIMD write operations, triggering out-of-bounds memory access. The issue is particularly acute because the SIMD routines operate on multiple bytes per instruction, making bounds checking difficult and increasing the scope of potential memory corruption.