---
id: "CVE-2026-124586"
page: "https://infrastack.ai/live/CVE-2026-124586"
kind: "vulnerability"
aliases: ["CVE-2026-124586"]
title: "RapidJSON: out-of-bounds read in number parsing lets remote input leak memory"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "rapidjson", "fixed": [], "affected": "1.1.0", "ecosystem": "vendor"}]
ecosystems: []
tags: ["c++", "json-parsing", "package", "rapidjson"]
not_affected_if: ["other-json-library", "trusted-input-only"]
published_at: "2026-11-09T10:17:08+00:00"
first_seen_at: "2026-11-09T10:25:49+00:00"
updated_at: "2026-11-09T10:27:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124586", "first_seen_at": "2026-11-09T10:25:49+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124586", "first_seen_at": "2026-11-09T10:27:29+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/CVE-2026-124586", "https://github.com/Tencent/rapidjson/releases", "https://github.com/Tencent/rapidjson/issues/2204"]}]
exploit_sources: []
---

# RapidJSON: out-of-bounds read in number parsing lets remote input leak memory

Link for people: https://infrastack.ai/live/CVE-2026-124586 (this .md is for agents)

Per NVD, RapidJSON 1.1.0 has an out-of-bounds read in GetCachedPowerByIndex (include/rapidjson/internal/diyfp.h) via the decimalPosition argument, reachable remotely through crafted JSON. NVD says the project was told through an issue and has not responded. The latest release is still v1.1.0 and I found no fix. The matching upstream issue was not located.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:rapidjson affected 1.1.0 fixed no fixed version listed

## How to check

- Find RapidJSON in your tree: grep -ri rapidjson in source, vendored third-party dirs, vcpkg/conan manifests.
- Check include/rapidjson/rapidjson.h or the manifest for version 1.1.0 (and any master snapshot, since no release is newer).
- Check whether the code parses untrusted JSON, in particular numbers with kParseFullPrecisionFlag; also look at include/rapidjson/internal/diyfp.h for GetCachedPowerByIndex.
- Also check other bundled copies (vendored inside other libraries).

## Fix

No patched release: latest RapidJSON release is v1.1.0 (the affected version); master has later commits but none is known to address this CVE.

## Timeline

- 2026-11-09T10:25:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124586
- 2026-11-09T10:27:29+00:00 analyst https://nvd.nist.gov/vuln/detail/CVE-2026-124586 — NVD (VulDB) says project was told via an issue and has not responded. Searched Tencent/rapidjson issues: no issue found that reports this OOB read (#2204/#2206 are unrelated precision questions; #2405 and #2408 are open, unanswered number-parsing memory bugs from Oct 2026 that may be related, not confirmed). Latest release is still v1.1.0; no fix known. web-cli had no credits and X was not checked. No PoC link found, so exploited stays false.

## Documents

- [advisory] NVD CVE-2026-124586 https://nvd.nist.gov/vuln/detail/CVE-2026-124586
- [describes] RapidJSON releases (latest v1.1.0) https://github.com/Tencent/rapidjson/releases
- [mentions] RapidJSON issue #2204 GetCachedPowerByIndex() (precision question, not an OOB report) https://github.com/Tencent/rapidjson/issues/2204

## From the sources

A vulnerability was determined in Tencent RapidJSON 1.1.0. Impacted is the function GetCachedPowerByIndex in the library include/rapidjson/internal/diyfp.h. This manipulation of the argument decimalPosition causes out-of-bounds read. It is possible to initiate the attack remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_