{"id":"CVE-2026-124586","kind":"vulnerability","aliases":["CVE-2026-124586"],"related":[],"title":"RapidJSON: out-of-bounds read in number parsing lets remote input leak memory","description":"A vulnerability was determined in Tencent RapidJSON 1.1.0. Impacted is the function GetCachedPowerByIndex in the library include/rapidjson/internal/diyfp.h. This manipulation of the argument decimalPosition causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.","summary":"Per NVD, RapidJSON 1.1.0 has an out-of-bounds read in GetCachedPowerByIndex (include/rapidjson/internal/diyfp.h) via the decimalPosition argument, reachable remotely through crafted JSON. NVD says the project was told through an issue and has not responded. The latest release is still v1.1.0 and I found no fix. The matching upstream issue was not located.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"rapidjson","fixed":[],"affected":"1.1.0","ecosystem":"vendor"}],"ecosystems":[],"tags":["c++","json-parsing","package","rapidjson"],"not_affected_if":["other-json-library","trusted-input-only"],"how_to_check":"- Find RapidJSON in your tree: grep -ri rapidjson in source, vendored third-party dirs, vcpkg/conan manifests.\n- Check include/rapidjson/rapidjson.h or the manifest for version 1.1.0 (and any master snapshot, since no release is newer).\n- Check whether the code parses untrusted JSON, in particular numbers with kParseFullPrecisionFlag; also look at include/rapidjson/internal/diyfp.h for GetCachedPowerByIndex.\n- Also check other bundled copies (vendored inside other libraries).","fix":"No patched release: latest RapidJSON release is v1.1.0 (the affected version); master has later commits but none is known to address this CVE.","status":"open","published_at":"2026-11-09T10:17:08+00:00","first_seen_at":"2026-11-09T10:25:49+00:00","triaged_at":"2026-11-09T10:26:06+00:00","updated_at":"2026-11-09T10:27:29+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T10:26:06Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"internet","title":"RapidJSON: out-of-bounds read in number parsing lets remote input leak memory","impact":"medium","summary":"RapidJSON 1.1.0 has an out-of-bounds read in GetCachedPowerByIndex in include/rapidjson/internal/diyfp.h, triggered through a manipulated decimalPosition argument. An attacker who can send crafted JSON to an application using the library can read memory beyond the intended buffer, possibly exposing data or causing a crash.","audience":"developers","category":"package","nicknames":[],"who_cares":["c++","rapidjson","json-parsing"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"out-of-bounds memory read leaks data or crashes the parser","analyst_note":"Find whether a patched RapidJSON release or commit exists and whether the upstream issue tracker has responded, since the sources state no fix.","how_to_check":"- Check whether the project depends on RapidJSON, for example with `grep -ri rapidjson` in the source tree or the vendored third-party directory.\n- Confirm the bundled version is `1.1.0` by looking at the library's version header or package manifest.","plain_action":"","product_name":"RapidJSON","needs_analyst":true,"not_affected_if":["other-json-library","trusted-input-only"],"who_is_affected":"Applications that embed RapidJSON 1.1.0 and parse JSON from untrusted sources are exposed. Projects that use a different JSON library, or that only parse trusted local files, are less exposed. The sources say the upstream project was reported the issue but has not responded.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000769,"input_tokens":4592,"output_tokens":620,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find whether a patched RapidJSON release or commit exists and whether the upstream issue tracker has responded, since the sources state no fix.","search":"'-124586':17A,20A '-2026':16A,19A '1.1.0':31B,89C 'argument':45B,103C 'attack':117C 'bound':5A,37B,109C 'c':22B 'caus':105C 'craft':49B 'cve':15A,18A 'decimalposit':44B,104C 'determin':85C 'disclos':124C 'earli':136C 'exploit':120C 'fix':74B 'found':72B 'function':93C 'getcachedpowerbyindex':40B,94C 'impact':90C 'include/rapidjson/internal/diyfp.h':41B,98C 'inform':132C 'initi':115C 'input':12A 'issu':59B,78B,139C 'json':24B,50B 'json-pars':23B 'latest':65B 'leak':13A 'let':10A 'librari':97C 'locat':81B 'manipul':100C 'match':76B 'may':126C 'memori':14A 'number':8A 'nvd':29B,51B 'out-of-bound':2A,34B,106C 'packag':26B 'pars':9A,25B 'per':28B 'possibl':113C 'problem':135C 'project':54B,130C 'public':123C 'rapidjson':1A,21A,27B,30B,88C 'reachabl':46B 'read':6A,38B,110C 'releas':66B 'remot':11A,47B,118C 'report':140C 'respond':63B,144C 'say':52B 'still':68B 'tencent':87C 'told':56B 'upstream':77B 'util':128C 'v1.1.0':69B 'via':42B 'vulner':83C 'yet':145C","nicknames":[],"mitigations":[],"who_affected":"Applications that embed RapidJSON 1.1.0 and parse JSON from untrusted sources are exposed. Projects that use a different JSON library, or that only parse trusted local files, are less exposed. The sources say the upstream project was reported the issue but has not responded.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":["rapidjson"],"ptokens":["rapidjson"],"labels":["c","high","jsonparsing","package","rapidjson"],"campaign_type":null,"search_a":"'-124586':17A,20A '-2026':16A,19A 'bound':5A 'cve':15A,18A 'input':12A 'leak':13A 'let':10A 'memori':14A 'number':8A 'out-of-bound':2A 'pars':9A 'rapidjson':1A,21A 'read':6A 'remot':11A","search_b":"'1.1.0':31B 'argument':45B 'bound':37B 'c':22B 'craft':49B 'decimalposit':44B 'fix':74B 'found':72B 'getcachedpowerbyindex':40B 'include/rapidjson/internal/diyfp.h':41B 'issu':59B,78B 'json':24B,50B 'json-pars':23B 'latest':65B 'locat':81B 'match':76B 'nvd':29B,51B 'out-of-bound':34B 'packag':26B 'pars':25B 'per':28B 'project':54B 'rapidjson':27B,30B 'reachabl':46B 'read':38B 'releas':66B 'remot':47B 'respond':63B 'say':52B 'still':68B 'told':56B 'upstream':77B 'v1.1.0':69B 'via':42B","search_c":"'1.1.0':89C 'argument':103C 'attack':117C 'bound':109C 'caus':105C 'decimalposit':104C 'determin':85C 'disclos':124C 'earli':136C 'exploit':120C 'function':93C 'getcachedpowerbyindex':94C 'impact':90C 'include/rapidjson/internal/diyfp.h':98C 'inform':132C 'initi':115C 'issu':139C 'librari':97C 'manipul':100C 'may':126C 'out-of-bound':106C 'possibl':113C 'problem':135C 'project':130C 'public':123C 'rapidjson':88C 'read':110C 'remot':118C 'report':140C 'respond':144C 'tencent':87C 'util':128C 'vulner':83C 'yet':145C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:08+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"cna@vuldb.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124586","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124586","severity":null,"published_at":"2026-11-09T10:17:08+00:00","modified_at":"2026-11-09T10:17:08+00:00","first_seen_at":"2026-11-09T10:25:49+00:00","fetched_at":"2026-11-09T10:25:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-124586:2268","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124586","severity":null,"published_at":"2026-11-09T10:27:29+00:00","modified_at":"2026-11-09T10:27:29+00:00","first_seen_at":"2026-11-09T10:27:29+00:00","fetched_at":"2026-11-09T10:27:29+00:00","note":"NVD (VulDB) says project was told via an issue and has not responded. Searched Tencent/rapidjson issues: no issue found that reports this OOB read (#2204/#2206 are unrelated precision questions; #2405 and #2408 are open, unanswered number-parsing memory bugs from Oct 2026 that may be related, not confirmed). Latest release is still v1.1.0; no fix known. web-cli had no credits and X was not checked. No PoC link found, so exploited stays false.","cites":["https://nvd.nist.gov/vuln/detail/CVE-2026-124586","https://github.com/Tencent/rapidjson/releases","https://github.com/Tencent/rapidjson/issues/2204"]}],"documents":[{"id":106982,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124586","title":"NVD CVE-2026-124586","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":106983,"url":"https://github.com/Tencent/rapidjson/releases","title":"RapidJSON releases (latest v1.1.0)","kind":"release","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":106984,"url":"https://github.com/Tencent/rapidjson/issues/2204","title":"RapidJSON issue #2204 GetCachedPowerByIndex() (precision question, not an OOB report)","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}