Rapidjson
Monthly
An out-of-bounds read (CWE-125) exists in Tencent RapidJSON up to and including 1.1.0, reachable through the library's Regex Parser component when the templated GenericStringStream<UTF8<char>>::Take function in include/rapidjson/stream.h is exercised; a successful trigger reads memory adjacent to the intended buffer, producing partial information disclosure and/or a crash rather than code execution. Exposure is conditional: because RapidJSON is a header-only C++ library with no network surface of its own, only applications that pass attacker-influenced data into the regex/schema validation path inherit the flaw - deployments that never use regex or schema functionality are not exposed. A public PoC reference exists (upstream GitHub issue #2401); it is not verified as working exploit code, and there is no CISA KEV entry, though SSVC records exploitation status as 'poc' and the EPSS score of 0.30% (23rd percentile) reflects low predicted exploitation activity.
An out-of-bounds read (CWE-125) exists in Tencent RapidJSON up to and including 1.1.0, reachable through the library's Regex Parser component when the templated GenericStringStream<UTF8<char>>::Take function in include/rapidjson/stream.h is exercised; a successful trigger reads memory adjacent to the intended buffer, producing partial information disclosure and/or a crash rather than code execution. Exposure is conditional: because RapidJSON is a header-only C++ library with no network surface of its own, only applications that pass attacker-influenced data into the regex/schema validation path inherit the flaw - deployments that never use regex or schema functionality are not exposed. A public PoC reference exists (upstream GitHub issue #2401); it is not verified as working exploit code, and there is no CISA KEV entry, though SSVC records exploitation status as 'poc' and the EPSS score of 0.30% (23rd percentile) reflects low predicted exploitation activity.