SimulationCraft EUVD-2026-112147

Exploitation requires that SimulationCraft parse attacker-controlled gear JSON in which a single equipped item's 'sockets' array contains more than four entries, triggering the unbounded loop in bcp_api.cpp that writes past the four-element gem_id/gem_bonus_id arrays (MAX_GEM_SLOTS=4). The malicious data must reach the parser via one of three paths: a crafted .simc profile with an [[equipment]] section fed to a local install or a service hosting SimulationCraft, a compromised WoW addon export, or an attacker in a privileged network position tampering with Battle.net API responses. LIMITING FACTORS: affected only in builds after release-820-01 and before the May 7, 2026 nightly (fixed in simc-1205-01-516b5d7); the victim or service must actually import and process the attacker-supplied profile/response; while the overflow and crash are reliable, turning it into reliable code execution requires heap grooming and control of the freed pointer (reflected in AC:H/AT:P). The crash itself is trivially reproducible from the published JSON PoC.

This is a genuine memory-corruption flaw (CWE-122/787) confirmed by the vendor's own GitHub Security Advisory (GHSA-wc9c-hfh3-phxx) and closed by fix commit aff85992, with a public crash-reproducing JSON PoC and a controlled free demonstrated via SIGSEGV. However, several signals temper real-world urgency. There is no CISA KEV listing (so 'confirmed actively exploited' does not apply) and no EPSS score was provided, so widespread-exploitation probability cannot be quantified from the data. The supplied CVSS 4.0 vector (7.5, High) models AV:A/AC:H/AT:P/PR:N/UI:P - unauthenticated but requiring adjacent position, elevated attack complexity, a special attack requirement, and passive user interaction - which is consistent with the Battle.net-API MITM scenario but does not capture the more realistic delivery path (a victim importing an attacker-supplied .simc profile), which is better modeled as a local vector. The vuln.today decision label is 'this_week', not act_now/emergency, which aligns with the gating conditions and the product's non-enterprise footprint. Net: a real, well-evidenced bug worth patching promptly, but SimulationCraft is a WoW theorycrafting desktop/hosted tool rather than critical infrastructure, so this is a legitimate but moderate priority rather than a drop-everything emergency. Conflict to verify: CVSS AV:A (adjacent) understates the file-import path and overstates the network path - the dominant exposure for most users is loading a malicious profile, not a privileged MITM.

An attacker crafts a malicious .simc profile with an [[equipment]] section containing a gear item whose JSON 'sockets' array holds more than four entries (or MITMs a Battle.net API response to inject them); when a victim or a hosting service imports and parses it, the unbounded loop writes past gem_id[3] into the adjacent gem_bonus_id vector's _M_start pointer, and the item_t destructor then frees an attacker-controlled pointer during normal cleanup. The advisory reports this was taken from crash to code execution in a testing environment. A crash-reproducing JSON PoC is public; full working RCE exploit code is not published (the reporter is withholding it pending a blog post).