simdjson CVE-2026-88358

Requires the target application to parse attacker-supplied JSON via simdjson 4.6.1's unpadded parse path (dom::parser::parse_unpadded, i.e. the UNPADDED=true branch of walk_document); applications using the standard padded parse API are not exposed. The malicious input must be a truncated JSON document whose final structural token closes a nested array or object, so that the buffer is exhausted exactly when the iterator reads buf[len]. Limiting factors: the impact is confined to availability (process termination / DoS), a single-byte OOB read may not fault on over-allocated heap buffers, and exploitation depends entirely on the deployment choosing the unpadded parsing mode.

This is a low-to-moderate real-world priority despite the 6.5 CVSS. All impact is availability-only: the CVSS vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H) and the description agree the outcome is a single-byte heap out-of-bounds read that at worst crashes the process (DoS) - there is no confidentiality or integrity impact (C:N/I:N), so no code execution or data theft. Signals are consistent and point toward low urgency: EPSS is 0.17% (6th percentile), the CVE is NOT in CISA KEV, and there is no public exploit - exploitation status is 'no public exploit identified at time of analysis.' The one nuance the raw score hides is that the flaw is specific to the unpadded parsing path (dom::parser::parse_unpadded / walk_document with the UNPADDED template branch introduced by the fix); applications using the standard padded parse API are not affected, which materially narrows the exposed population below what AV:N/PR:N implies. A one-byte OOB read on a typically over-allocated heap buffer also frequently will not fault at all, making 'A:H' somewhat optimistic. Net: a legitimate hardening fix for services that parse untrusted JSON via the unpadded path, but not an emergency.

An attacker sends a specially crafted, truncated JSON document (whose final structural token closes a nested array or object) to a service that parses untrusted input using simdjson's unpadded parse path. walk_document reads buf[len] one byte past the exhausted buffer, causing a heap OOB read that may terminate the application, denying service. No public exploit code exists, though the triggering issue and fix are documented in the project's GitHub issue #2815 and PR #2817.