Integer Overflow Patched in simdjson Library

An integer overflow in simdjson's string_builder::escape_and_append() can cause out-of-bounds reads on 32-bit platforms, fixed in version 4.6.4.

CERT Polska coordinated disclosure of CVE-2026-8295, an integer overflow vulnerability in the simdjson document-builder API. The flaw arises in string_builder::escape_and_append() when processing very large input strings on platforms with limited size_t width, such as 32-bit builds, leading to incorrect buffer size calculations.

Insufficient buffer allocation resulting from the overflow can cause out-of-bounds memory reads in SIMD routines, potentially leading to information disclosure, memory corruption, or malformed JSON output. The vulnerability was responsibly reported by Michał Majchrowicz and Marcin Wyczechowski from AFINE and has been fixed in simdjson release 4.6.4. There is no indication of active exploitation; this is a standard coordinated disclosure and patch advisory.

Source reporting: https://cert.pl/en/posts/2026/05/CVE-2026-8295