Simc
Monthly
Heap-based out-of-bounds write in SimulationCraft builds after release-820-01 and before the May 7, 2026 nightly, fixed in simc-1205-01-516b5d7, allows attacker-controlled gear JSON with more than four socket entries to overflow the four-element gem_id array and corrupt adjacent gem_bonus_id vector storage. The vendor advisory reports crashes and demonstrated code execution in a testing environment, but assessed exploitation requires the victim or hosted service to import malicious .simc profile data, a compromised addon export, or tampered Battle.net API responses, with high attack complexity and user interaction; a public crash-reproducing JSON PoC exists, and no CISA KEV entry or confirmed active exploitation is reported.
Heap-based out-of-bounds write in SimulationCraft builds after release-820-01 and before the May 7, 2026 nightly, fixed in simc-1205-01-516b5d7, allows attacker-controlled gear JSON with more than four socket entries to overflow the four-element gem_id array and corrupt adjacent gem_bonus_id vector storage. The vendor advisory reports crashes and demonstrated code execution in a testing environment, but assessed exploitation requires the victim or hosted service to import malicious .simc profile data, a compromised addon export, or tampered Battle.net API responses, with high attack complexity and user interaction; a public crash-reproducing JSON PoC exists, and no CISA KEV entry or confirmed active exploitation is reported.