CVE-2026-88358

Name of the Vulnerable Software and Affected Versions simdjson version 4.6.1

Description A one-byte out-of-bounds read exists in the dom::parser::parse unpadded() function. A specially crafted truncated JSON document, where the final structural token closes a nested array or object, can cause the json iterator::walk document() function to access buf[len] after the input buffer is exhausted. This heap out-of-bounds read may lead to application termination and a resulting denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.