Live › vulnerability › CVE-2026-116620
Go to dashboardRapidJSON, a C++ JSON library, has an out-of-bounds read in its regex parser stream code (GenericStringStream::Take in include/rapidjson/stream.h) affecting versions up to 1.1.0. The exploit is public, and an attacker can trigger it remotely, which may expose adjacent process memory.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 01:34 UTC. All times on this page are UTC.
Applications that use RapidJSON up to version 1.1.0 and feed untrusted input into its regex functionality are the exposed ones. The sources do not say whether plain JSON parsing without regex is affected, so teams that only parse JSON without regex features should verify that before deciding urgency.
No product ranges from the sources yet.
include/rapidjson/stream.h or rapidjson in your dependency manifests and CMake/Conan files1.1.0 and earlier, and the sources do not say which version is fixedGenericRegex, Regex)1.1.0Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A security vulnerability has been detected in Tencent RapidJSON up to 1.1.0. This issue affects the function GenericStringStream<UTF8<char>>::Take in the library include/rapidjson/stream.h of the component Regex Parser. The manipulation leads to out-of-bounds read. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. The project was informed of the problem early through an issue report but has not responded yet.
This page as .md · .json · in your agent: get_signal("CVE-2026-116620")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.